Auditbeat fatal error (crash)

auditbeat occasionally crashes with the following error:

The package is build with master branch (head commit b84e083625ec10)
OS: SMP Debian 4.9.88-1+deb9u1
Kernel: 4.9.0-6-amd64

As I can see commit 124c8a28f9 introduce the problem with that:

        for i := 0; i < numConsumers; i++ {
                go func() {
                        defer wg.Done()
                        for {
                                select {
                                case <-reporter.Done():
                                case msgs := <-out:
                                        reporter.Event(buildMetricbeatEvent(msgs, ms.config))

numConsumers is equal with the number of the cpus (max = 4)

which is unsafe.
( if I set up max_procs: 1 at auditbeat.yml the problem goes away )

cc @adrisr

As I can see It is fixed at go-libaudit

I make a pull request

1 Like

Thanks! :slight_smile: