[7.17](backport #39362) [Auditbeat/FIM/fsnotify]: prevent losing even…

…ts for recursive mode on OS X (#39374) * [Auditbeat/FIM/fsnotify]: prevent losing events for recursive mode on OS X (#39362) * fix(auditbeat/fim/fsnotify): do not return error immediately as this causes losing events on mac * doc: update CHANGELOG.next.asciidoc (cherry picked from commit bbf8746) * doc: remove redundant changes from CHANGELOG.next.asciidoc --------- Co-authored-by: Panos Koutsovasilis <[email protected]>
elastic · May 7, 2024 · 5fa88ce · 5fa88ce
1 parent e6486ed
commit 5fa88ce
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 3 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -36,6 +36,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 
 
 - Prevent scenario of losing children-related file events in a directory for recursive fsnotify backend of auditbeat file integrity module {pull}39133[39133]
+- Fix losing events in FIM for OS X by allowing always to walk an added directory to monitor {pull}39362[39362]
 
 
 *Filebeat*

diff --git a/auditbeat/module/file_integrity/monitor/monitor_test.go b/auditbeat/module/file_integrity/monitor/monitor_test.go
@@ -232,7 +232,7 @@ func TestRecursiveSubdirPermissions(t *testing.T) {
 
 	ev, err := readTimeout(t, watcher)
 	assert.Equal(t, errReadTimeout, err)
-	if err != errReadTimeout {
+	if !errors.Is(err, errReadTimeout) {
 		t.Fatalf("Expected timeout, got event %+v", ev)
 	}
 

diff --git a/auditbeat/module/file_integrity/monitor/recursive.go b/auditbeat/module/file_integrity/monitor/recursive.go
@@ -114,11 +114,11 @@ func (watcher *recursiveWatcher) addRecursive(path string) error {
 		return nil
 	}
 
+	var errs multierror.Errors
 	if err := watcher.watchFile(path, nil); err != nil {
-		return fmt.Errorf("failed adding watcher to '%s': %w", path, err)
+		errs = append(errs, fmt.Errorf("failed adding watcher to '%s': %w", path, err))
 	}
 
-	var errs multierror.Errors
 	err := filepath.Walk(path, func(walkPath string, info os.FileInfo, fnErr error) error {
 		if walkPath == path {
 			return nil
Original file line number	Diff line number	Diff line change
Expand Up		@@ -36,6 +36,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d


		- Prevent scenario of losing children-related file events in a directory for recursive fsnotify backend of auditbeat file integrity module {pull}39133[39133]
		- Fix losing events in FIM for OS X by allowing always to walk an added directory to monitor {pull}39362[39362]


		Filebeat
Expand Down