elastic / elastic/go-libaudit

auditbeat ERROR: get status request failed:failed to get audit status reply: no reply received

Open
#125 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
162
Forks
74
PR merge metrics
No merged PRs in 30d

Description

original issue: https://github.com/elastic/beats/issues/33258

long story short: we run `auditbeat` as DaemonSet on GKE clusters with slightly different versions, some nodes run `docker`, other nodes run `containerd`.

it runs with all permissions it needs, `journald` already unregistered by an initContainer so `auditbeat` can get audit events.
Problem is that some random `auditbeat` pods keep outputting this error until we restart them:
```
ERROR: get status request failed:failed to get audit status reply: no reply received
```
and if we restart a totally fine `auditbeat` pod, it might start outputting that error too.

it doesn't however stop writing audit logs to elasticsearch. we get audit logs from the pods that are outputting the error as much as the other pods.

I traced down the error to this block of code:
https://github.com/elastic/go-libaudit/blob/6fba496da1d8846f7b00fecf719fb5aa43f0e91d/audit.go#L496-L498

Wouldn't it be okay if `msgs` was empty? At this point we already got through this without any error:
https://github.com/elastic/go-libaudit/blob/6fba496da1d8846f7b00fecf719fb5aa43f0e91d/audit.go#L480-L494

and `func (c *NetlinkClient) Receive()` already got the appropriate error checks here:
https://github.com/elastic/go-libaudit/blob/6fba496da1d8846f7b00fecf719fb5aa43f0e91d/netlink.go#L152-L190

Shouldn't `len(msgs) == 0` be reported as a warning instead of an error?

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.