[Auditbeat] Default distribution fails to start on aarch64

[liza-mae]

For confirmed bugs, please report:

• Version: 7.11.0 BC1
• Operating System: Ubuntu aarch64
• Steps to Reproduce:
  Install auditbeat and try to start, observe error

2021-01-03T21:25:57.910Z	INFO	instance/beat.go:437	auditbeat stopped.
2021-01-03T21:25:57.913Z	ERROR	instance/beat.go:971	Exiting: 1 error: metricset 'system/socket' not found

Same thing happens on 7.10.1 so not a regression. The oss distribution works.

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[adriansr]

You need to disable the socket dataset in the system module. It only works on x86 architectures.

[liza-mae]

Thanks let me try, is it documented or do we need to document this?

[liza-mae]

This is the document I found: https://www.elastic.co/guide/en/beats/auditbeat/7.11/auditbeat-module-system.html - does it make sense to add something about it there?

[andrewkroh]

We should update the config template to only include the modules that work for arm64. Then the config file will work out of the box.

beats/x-pack/auditbeat/module/system/_meta/config.yml.tmpl

Lines 23 to 24 in 518e8b3

	{{- if eq .GOOS "linux" }}
	- socket # Opened and closed sockets

[liza-mae]

Sounds good @andrewkroh

[fearful-symmetry]

This should be an easy fix, I'll see if I can knock it out

[liza-mae]

Thank you @fearful-symmetry - it would be nice if we can get it into 7.11.0 and 7.10.2 upcoming releases.

I already tested removing the system module and auditbeat comes up, having it do so out of the box would be best.

[fearful-symmetry]

@adriansr do we know what parts of the system module do work on aarch64?

[liza-mae]

It may make sense to also update the documentation to say something about Linux aarch64 system module. Thoughts?

The module is fully implemented for Linux. Some datasets are also available for macOS (Darwin) and Windows.

[fearful-symmetry]

Yah, with the coming age of M1 macs, we might want to be more explicit with ARM support

[fearful-symmetry]

Fix here: #23381

Apologies for the delay, my country is struggling with democracy and the news is a tad distracting.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

Pinging @elastic/agent (Team:Agent)

[fearful-symmetry]

I think we're good to close this.