Cherry-pick #9994 to 6.x: Do not stop collecting events when journal …

…entries change (#10485) Cherry-pick of PR #9994 to 6.x branch. Original message: Previously sd_journal_wait was not used. From now on all changes to journals are detected. I also added custom seccomp policy to Journalbeat. Closes #9533
elastic · Feb 4, 2019 · fbc9dcc · fbc9dcc
1 parent 190d2a1
commit fbc9dcc
Show file tree

Hide file tree

Showing 6 changed files with 329 additions and 189 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -97,6 +97,7 @@ https://github.com/elastic/beats/compare/v6.6.0...6.x[Check the HEAD diff]
 *Journalbeat*
 
 - Add missing journalbeat non breaking fixes. {pull}9106[9106]
+- Do not stop collecting events when journal entries change. {pull}9994[9994]
 
 *Metricbeat*
 

diff --git a/journalbeat/_meta/kibana/6/dashboard/Journalbeat-overview.json b/journalbeat/_meta/kibana/6/dashboard/Journalbeat-overview.json
diff --git a/journalbeat/beater/journalbeat.go b/journalbeat/beater/journalbeat.go
@@ -31,6 +31,7 @@ import (
 	"github.com/elastic/beats/libbeat/logp"
 
 	conf "github.com/elastic/beats/journalbeat/config"
+	_ "github.com/elastic/beats/journalbeat/include"
 )
 
 // Journalbeat instance

diff --git a/journalbeat/include/seccomp_linux_386.go b/journalbeat/include/seccomp_linux_386.go