Metricbeat reports incorrect (outdated?) kernel version

  • Version: 7.7.1
  • Operating System: OpenSUSE 15.1

I have several hosts running metricbeat. One of them is currently reporting an incorrect kernel version (5.4.10):

In reality, this host is on 5.1.17:

uname -a
Linux hive 5.1.17-x86_64-linode128 #1 SMP PREEMPT Wed Jul 10 17:11:49 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

and has been for the past 34 days.

However, as you can see Kibana reports 5.4.10-x86_64-linode132 for some reason, even when I set the time to the last 2 seconds.

Curiously, I have another server which has been on 5.1.17 even longer now, and there Kibana/metricbeat report the correct kernel version:

So, why does the kernel version go stale? When is it updated? This is a bug.

This also brings up the question of what happens when the kernel version changes. Ideally, the correct version for the given time slice would be reported, even multiple ones if the kernel was updated.

Hi @archon810 :slightly_smiling_face:

Let me clarify first that we are not testing the system module in OpenSUSE. Said that, it's very unlikely that Metricbeat has a bug parsing kernel version that, by pure coincidence, produces a incorrect kernel version in the correct format.

As far as I know, kernel version is fetched and parsed on each "fetch" pass (ever X seconds) and it is not cached.

Are you sure you don't have a duplicated hostname, you are looking at the incorrect machine or anything like this? I'm open to think that we might have a bug, it's just that it seems unlikely that it's there.

@Mario_Castro Thanks for replying. I poked around in the configs, and I can't see what we'd have set up wrong that would have resulted in this discrepancy.

There are 4 hosts, each with their own kibana and ES, both clustered. The host name is clearly present in all queries and in metricbeat.

Btw, even if I select the last 1s of data in kibana's Metrics menu, and no data is showing because no such data has been collected, the kernel version is still shown there. So where does that data come from in that case?

Upgraded to

uname -a
Linux citadel 5.6.14-x86_64-linode135 #1 SMP PREEMPT Fri May 22 14:57:20 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

But Kibana continues to show 5.1 kernel. Can we treat this as a bug now?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.