Auditbeat fatal error (crash)


(Panagiotis Panagiotopoulos) #1

auditbeat occasionally crashes with the following error:

https://pastebin.com/h6ibjEjd

The package is build with master branch (head commit b84e083625ec10)
OS: SMP Debian 4.9.88-1+deb9u1
Kernel: 4.9.0-6-amd64


(Panagiotis Panagiotopoulos) #2

As I can see commit 124c8a28f9 introduce the problem with that:

        for i := 0; i < numConsumers; i++ {
                go func() {
                        defer wg.Done()
                        for {
                                select {
                                case <-reporter.Done():
                                        return
                                case msgs := <-out:
                                        reporter.Event(buildMetricbeatEvent(msgs, ms.config))
                                }   
                        }   
                }() 
        }

numConsumers is equal with the number of the cpus (max = 4)

which is unsafe.
( if I set up max_procs: 1 at auditbeat.yml the problem goes away )

cc @adrisr


(Panagiotis Panagiotopoulos) #3

As I can see It is fixed at go-libaudit

I make a pull request https://github.com/elastic/beats/pull/7898


(Jaime Soriano) #4

Thanks! :slight_smile: