Auditbeat version: 7.15.2
Operating system: Rocky Linux (4.18.0-348.12.2.el8_5.x86_64)
My issue is similar to the one discussed here, but the fixes that were put in 7.10 do not work here. Commenting out the socket dataset fixes auditbeat but I also lose out on valuable information.
I can confirm:
- Setting a higher socket.guess_timeout does not fix it
- /proc/sys/kernel/ftrace_enabled is set to 1
- /sys/kernel/debug/kprobes/enabled is also set to 1
- ipv6 is disabled, both on the system and in auditbeat (this issue mentioned ipv6 but I don't think it's that)
- Neither modules.d nor config reloading are being used
module config:
- module: system
datasets:
- host
- login
- package
- process
- socket
- user
socket.enable_ipv6: false
Sample of logs:
2022-02-24T01:37:01.366Z DEBUG [modules] beater/metricbeat.go:151 Available modules and metricsets: Register [ModuleFactory:[system], MetricSetFactory:[auditd/auditd, file_integrity/file, system/host, system/login, system/package, system/process, system/socket, system/user]]
2022-02-24T01:37:01.367Z WARN [cfgwarn] host/host.go:188 BETA: The system/host dataset is beta
2022-02-24T01:37:01.368Z DEBUG [system] host/host.go:472 Restored last host information from disk.
2022-02-24T01:37:01.368Z WARN [cfgwarn] login/login.go:95 BETA: The system/login dataset is beta
2022-02-24T01:37:01.368Z DEBUG [login] login/utmp.go:546 Restored 2 UTMP file records from disk
2022-02-24T01:37:01.368Z DEBUG [login] login/utmp.go:578 Restored 1 open login sessions from disk
2022-02-24T01:37:01.368Z WARN [cfgwarn] package/package.go:201 BETA: The system/package dataset is beta
2022-02-24T01:37:01.369Z DEBUG [package] package/package.go:232 Last state was sent at 2022-02-24 00:31:41.858757849 +0000 UTC. Next state update by 2022-02-24 12:31:41.858757849 +0000 UTC.
2022-02-24T01:37:01.369Z DEBUG [package] package/package.go:242 Restored 401 packages from disk
2022-02-24T01:37:01.370Z WARN [cfgwarn] process/process.go:146 BETA: The system/process dataset is beta
2022-02-24T01:37:01.370Z DEBUG [process] process/process.go:183 Last state was sent at 2022-02-24 00:31:52.993867 +0000 UTC. Next state update by 2022-02-24 12:31:52.993867 +0000 UTC.
2022-02-24T01:37:01.370Z WARN [cfgwarn] socket/socket_linux.go:124 BETA: The system/socket dataset is beta.
2022-02-24T01:37:01.378Z INFO [socket] socket/socket_linux.go:259 Setting up system/socket for kernel 4.18.0-348.12.2.el8_5.x86_64
2022-02-24T01:37:01.379Z DEBUG [socket] socket/socket_linux.go:306 IPv6 supported: false
2022-02-24T01:37:01.379Z DEBUG [socket] socket/socket_linux.go:313 IPv6 enabled: false
2022-02-24T01:37:01.514Z DEBUG [socket] socket/socket_linux.go:374 Selected kernel function __ip_local_out for IP_LOCAL_OUT
2022-02-24T01:37:01.514Z DEBUG [socket] socket/socket_linux.go:374 Selected kernel function __skb_recv_udp for RECV_UDP_DATAGRAM
2022-02-24T01:37:01.514Z DEBUG [socket] socket/socket_linux.go:374 Selected kernel function __x64_sys_execve for SYS_EXECVE
2022-02-24T01:37:01.514Z DEBUG [socket] socket/socket_linux.go:374 Selected kernel function __x64_sys_gettimeofday for SYS_GETTIMEOFDAY
2022-02-24T01:37:01.514Z DEBUG [socket] socket/socket_linux.go:374 Selected kernel function __x64_sys_newuname for SYS_UNAME
2022-02-24T01:37:01.520Z INFO [socket] guess/guess.go:258 Running 17 guesses ...
2022-02-24T01:37:01.520Z DEBUG [socket] guess/guess.go:270 Guess guess_inet_sock_ipv6 skipped.
2022-02-24T01:37:16.558Z WARN [cfgwarn] user/user.go:232 BETA: The system/user dataset is beta
2022-02-24T01:37:16.559Z DEBUG [user] user/user.go:272 Last state was sent at 2022-02-24 00:31:42.295524292 +0000 UTC. Next state update by 2022-02-24 12:31:42.295524292 +0000 UTC.
2022-02-24T01:37:16.559Z DEBUG [user] user/user.go:282 Restored 24 users from disk
2022-02-24T01:37:16.559Z INFO instance/beat.go:442 auditbeat stopped.
2022-02-24T01:37:16.559Z ERROR instance/beat.go:989 Exiting: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess_sockaddr_in failed: timeout while waiting for trigger to complete
Exiting: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess_sockaddr_in failed: timeout while waiting for trigger to complete
The parameter it fails on can vary - sometimes it's guess_udp_sendmsg, sometimes it's others.
Any ideas of what could be going wrong? Weirdly enough, this did work fine at one point, but now it crashes.
Many thanks!