elastic / elastic/beats

[Flaky Test] github.com/elastic/beats/v7/auditbeat/module/file_integrity TestBackendFallback

Open
#50,032 12 comments 0 reactions 0 assignees View on GitHub
flaky-test Team:Security-Service Integrations
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 15m
Merged PRs (30d)
385

Description

## Flaky Test

* **Test Name:** TestBackendFallback
* **Scope:** github.com/elastic/beats/v7/auditbeat/module/file_integrity
* **File:** N/A
* **Location:** N/A
* **Buildkite Link:** https://buildkite.com/organizations/elastic/analytics/suites/beats/tests/4bec0134-a9d8-833e-969e-fe593b27fc6a
* **Flaky Instances:** 6
* **Latest Occurrence:** 2026-04-09T09:39:59.333Z

### Details

```json
{
"id": "4bec0134-a9d8-833e-969e-fe593b27fc6a",
"web_url": "https://buildkite.com/organizations/elastic/analytics/suites/beats/tests/4bec0134-a9d8-833e-969e-fe593b27fc6a",
"scope": "github.com/elastic/beats/v7/auditbeat/module/file_integrity",
"name": "TestBackendFallback",
"location": null,
"file_name": null,
"instances": 6,
"latest_occurrence_at": "2026-04-09T09:39:59.333Z",
"most_recent_instance_at": "2026-04-09T09:39:59.333Z",
"last_resolved_at": null,
"ownership_team_ids": [],
"failure_examples_count": 4
}
```

### Failure Examples

**Example 1:**
**Run:** https://api.buildkite.com/v2/analytics/organizations/elastic/suites/beats/runs/70327909-989f-8574-b51f-0dae42c3727d
**Time:** 2026-04-09T09:01:42.947Z
**Stacktrace:**

```
=== RUN TestBackendFallback
eventreader_test.go:441:
Error Trace: /go/src/github.com/elastic/beats/auditbeat/module/file_integrity/eventreader_test.go:441
Error: Received unexpected error:
error getting kprobes: error creating perf buffer channels: error adding kprobe_fsnotify_inode probe: write /sys/kernel/tracing/kprobe_events: file exists
error creating perf buffer channels: error adding kprobe_vfs_getattr_nosec probe: write /sys/kernel/tracing/kprobe_events: file exists
error creating perf buffer channels: error creating decoder for kprobe_fsnotify_inode: field 'pi' not found in kprobe format description
error creating perf buffer channels: error creating decoder for kprobe___fsnotify_parent: field 'pi' not found in kprobe format description
could not validate probes
Test: TestBackendFallback
Messages: Start() should succeed after successful initialization
--- FAIL: TestBackendFallback (7.88s)

```

**Example 2:**
**Run:** https://api.buildkite.com/v2/analytics/organizations/elastic/suites/beats/runs/70327909-989f-8574-b51f-0dae42c3727d
**Time:** 2026-04-09T09:01:42.947Z
**Stacktrace:**

```
=== RUN TestBackendFallback
eventreader_test.go:441:
Error Trace: /go/src/github.com/elastic/beats/auditbeat/module/file_integrity/eventreader_test.go:441
Error: Received unexpected error:
error getting kprobes: error creating perf buffer channels: error adding kprobe___fsnotify_parent probe: write /sys/kernel/tracing/kprobe_events: file exists
error creating perf buffer channels: error adding kprobe_vfs_getattr_nosec probe: write /sys/kernel/tracing/kprobe_events: file exists
error creating perf buffer channels: error loading kprobe_fsnotify_inode probe format data: bad format for kprobe 'p:auditbeat_fim/kprobe_fsnotify_inode fsnotify pi=+64(%cx):u64 mc=%di:b1@8/32 md=%di:b1@9/32 ma=%di:b1@2/32 mm=%di:b1@1/32 mid=%di:b1@30/32 mmt=%di:b1@7/32 mmf=%di:b1@6/32 nptr=%r8:u64 fi=+64(%si):u64 dt=%dx:s32 fdmj=+16(+40(%si)):b12@20/32 fdmn=+16(+40(%si)):b10@0/32 pdmj=+16(+40(%cx)):b12@20/32 pdmn=+16(+40(%cx)):b10@0/32 fn=+0(+8(%r8)):string': unknown parameter=`W.��>3���,��>3��#��>3���%��>3��G,��>3���'��>3��o%��>3�LJ"��>3���%��>3���-��>3��'!��>3���,��>3���!��>3���/��>3���(��>3��'�����V��` in type=`u64 W.��>3���,��>3��#��>3���%��>3��G,��>3���'��>3��o%��>3�LJ"��>3���%��>3���-��>3��'!��>3���,��>3���!��>3���/��>3���(��>3��'�����V�� ��>3��g!��>3�/�!��>3�'?,��>3�?�/��>3�7�+��>3�O�'��>3�G�&��>3�_� ��>3�W�-��>3�oW&��>3�g?+��>3��$��>3�w�,��>3���&��>3��G)��>3��o,��>3���&��>3���)��>3��'/��>3���(��>3���)��>3�ϧ/��>3�ǟ$��>3���-��>3���"��>3��w*��>3���!��>3��//��>3��' ��>3���#��>3���!��>3���%��>3��g+��>3�/O&��>3�'�!��>3�?�$��>3�7W)��>3�O?(��>3�G�'��>3�_�,��>3�WW'��>3�o� ��>3�g� ��>3�G%��>3�w/$��>3��w+��>3���!��>3��� ��>3��� ��>3���'��>3���$��>3��o'��>3���(��>3��o-��>3���-��>3��?!��>3���/��>3��'(��>3��g&��>3��7%��>3��� ��>3���(��>3��?"��>3���&��>3���&��>3�/G-��>3�'�(��>3�?�'��>3�7�)��>3�O�#��>3�G�,��>3�_G*��>3�W�*��>3�o�*��>3�gW,��>3��!��>3�w�"��>3���'��>3��$��>3���$��>3��/'��>3���-��>3���#��>3��� ��>3���%��>3�Ϸ ��>3���,��>3��7 ��>3���)��>3���+��>3���*��>3���"��>3���+��>3��/%��>3��W/��>3��_"��>3���&��>3�/_,��>3�'�-��>3�?7+��>3�7�"��>3�O�)��>3�G7(��>3�_g.��>3�W_!��>3�o�'��>3�g'�����S��)��>3�w� ��>3�� ��>3���/��>3��w&��>3��� ��>3���#��>3��G ��>3��7/��>3���(��>3���"��>3���.��>3���#��>3���!��>3���*��>3���"��>3��7,��>3��w ��>3��?*��>3��� ��>3���-��>3���/��>3�/�)��>3�'�*��>3�?�"��>3�7�"��>3�OW(��>3�G_ ��>3�_�,��>3�W�%��>3�o�.��>3�gW"��>3��,��>3�ww"��>3���,��>3��7#��>3��',��>3���"��>3���'��>3���%��>3��&��>3���/��>3���!��>3��W!��>3��?)��>3���"��>3��/.��>3��g'��>3��w(��>3��� ��>3���)��>3��g)��>3���#��>3���)��>3�/'"��>3�'�#��>3�?�.��>3�7�)��>3�O�(��>3�G.��>3�_�%��>3�W�)��>3�o�#��>3�g�*��>3�/,��>3�w�!��>3��O-��>3���-��>3���&��>3���+��>3���-��>3��/!��>3���+��>3���'��>3�Ͽ/��>3��g/��>3���.��>3�׷'��>3���"��>3��O+��>3���&��>3���!��>3���&��>3��_)��>3��W#��>3���/��>3�//)��>3�'�"��>3�?�)��>3�7�,��>3�OG$��>3�G�-��>3�__#��>3�W�*��>3�o�*��>3�gw!��>3�W*��>3�w+��>3��_%��>3���$��>3���/��>3���!��>3��o&��>3���$��>3��O%��>3���.��>3��(��>3��?&��>3�ߗ.��>3��'#��>3���/��>3��7)��>3���+��>3��O'��>3��o/��>3���&��>3��,��>3���/��>3�/_.��>3�'�*��>3�?�,��>3�7�*��>3�O�"��>3�Go)��>3�_�!��>3�W�.��>3�og"��>3�g'$��>3�7.��>3�w�.��>3���$��>3���+��>3���*��>3���+��>3���+��>3��7'��>3���/��>3��g-��>3��!��>3��?#��>3���(��>3���&��>3��� ��>3���(��>3���.��>3��/-��>3��'-��>3��g,��>3���+��>3��o+��>3�/G&��>3�'/(��>3�?�,��>3�7W ��>3�O�*��>3�G�.��>3�_'.��>3�W�$��>3�ow.��>3�g� ��>3��)��>3�w_(��>3���-��>3��7"��>3���(��>3���%��>3��_-��>3���&��>3��o"��>3���%��>3�χ&��>3���#��>3���)��>3��"��>3���*��>3��� ��>3���#��>3���%��>3��o#��>3���,��>3��g$��>3���/��>3�/�,��>3�'�)��>3�?�-��>3�7g#��>3�O_&��>3�GG!��>3�_�-��>3�W�"��>3�o?%��>3�gw)��>3�G#��>3�w�#��>3���%��>3���(��>3���$��>3��o ��>3���#��>3��W-��>3��*��>3��w#��>3��O(��>3�Ƿ&��>3�ߧ!��>3���*��>3���$��>3��7&��>3���#��>3���*��>3���(��>3���'��>3��w%��>3���)��>3�//+��>3�'G(��>3�?�,��>3�7/ ��>3�O� ��>3�G�$��>3�_�/��>3�W�+��>3�o�,��>3�g�/��>3��*��>3�w�#��>3���*��>3��w-��>3��%��>3��� ��>3���%��>3���"��>3���-��>3���"��>3�χ,��>3��w$��>3��-��>3���&��>3���%��>3���'��>3��O!��>3���#��>3��w,��>3���%��>3��7$��>3���*��>3�/�-��>3�'7!��>3�??-��>3�7�$��>3�O/#��>3�G�%��>3�_�!��>3�Wo!��>3�oO#��>3�g�-��>3�')��>3�wO"��>3���'��>3���+��>3���(��>3���"��>3��?'��>3���)��>3��o(��>3��� ��>3�Ϗ)��>3��7-��>3���-��>3�ח*��>3���!��>3��/"��>3���+��>3���.��>3���$��>3��w'��>3���/��>3���)��>3�/'%��>3�'�!��>3�?'��>3�7�'��>3�O?$��>3�G'&��>3�_�'��>3�Wo.��>3�o/*��>3�gO/��>3��$��>3�wO*��>3���%��>3���*��>3��'*��>3���%��>3���'��>3��''��>3���'��>3��/&��>3�ϯ(��>3��� ��>3�߯.��>3��7*��>3��O)��>3��w/��>3��_+��>3��o*��>3���-��>3���.��>3��g%��>3���&��>3�/�+��>3�'W$��>3�?�+��>3�7�%��>3�O�!��>3�G)��>3�_?/��>3�WG/��>3�o�#��>3�g�.��>3��&��>3�w�(��>3���-��>3���+��>3���+��>3���+��>3���%��>3���$��>3��?.��>3���#��>3�Ͽ#��>3�Ǐ$��>3��_*��>3���+��>3���"��>3��G"��>3���%��>3��W+��>3���/��>3��/��>3���(��>3���&��>3�/�(��>3�'�.��>3�?? ��>3�7�"��>3�O�$��>3�G�/��>3�_�$��>3�WW%��>3�o�.��>3�g�(��>3�_'��>3�w�.��>3���,��>3��_/��>3���-��>3��O,��>3���/��>3���$��>3��G.��>3��g(��>3��g ��>3���&��>3��G'��>3�ׇ(��>3��_$��>3���#��>3��o$��>3���[]������d]�����`
error creating perf buffer channels: error adding kprobe_vfs_getattr_nosec probe: write /sys/kernel/tracing/kprobe_events: file exists
could not validate probes
Test: TestBackendFallback
Messages: Start() should succeed after successful initialization
--- FAIL: TestBackendFallback (8.32s)

```

**Example 3:**
**Run:** https://api.buildkite.com/v2/analytics/organizations/elastic/suites/beats/runs/bf25fc5f-dfda-8bb4-ba06-8d024f54e7bc
**Time:** 2026-04-08T17:17:06.689Z
**Stacktrace:**

```
=== RUN TestBackendFallback
eventreader_test.go:441:
Error Trace: /go/src/github.com/elastic/beats/auditbeat/module/file_integrity/eventreader_test.go:441
Error: Received unexpected error:
error getting kprobes: error creating perf buffer channels: error adding kprobe_fsnotify_path probe: write /sys/kernel/tracing/kprobe_events: file exists
error creating perf buffer channels: error adding kprobe_vfs_getattr_nosec probe: write /sys/kernel/tracing/kprobe_events: file exists
error creating perf buffer channels: error creating decoder for kprobe_fsnotify_inode: wrong struct field size for field 'mmt', got=4 required=8
error creating perf buffer channels: error creating decoder for kprobe___fsnotify_parent: wrong struct field type for field 'mc', it should be string
could not validate probes
Test: TestBackendFallback
Messages: Start() should succeed after successful initialization
--- FAIL: TestBackendFallback (7.89s)

```

Contributor guide

Open the contributing guide

Research direction

Start with TestBackendFallback at auditbeat/module/file_integrity/eventreader_test.go:441 and review the Buildkite failure examples. Reproduce the failure in the file_integrity test scope, then verify that repeated runs no longer fail and that Start() succeeds after initialization.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
operating-systems, testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.