Fix waiting for new events

[kvch]

• Adding more syscalls to the whitelist in libbeat
  I have removed the seccomp policy of journalbeat. Four new syscalls has been added to the common policy instead: fstatfs, getrlimit, ppoll and splice.
• Eliminate possible deadlock when closing the client
• Previously, journalbeat was unable to read new entries from the journal after it has been started. Now it is fixed, and the reader code is much simpler now.
• updated vendored github.com/coreos/go-systemd/sdjournal to latest release (no changes)

[andrewkroh]

I don't see anything egregious in what you are adding so I think you should just add these syscalls to the default policy in libbeat.

Confirming what you said in the description, the diff is:

26a27
> 					"fstatfs",
38a40
> 					"getrlimit",
65a68
> 					"ppoll",
91a95
> 					"splice",

[urso]

according to docs c is uint64. Why does this compile?

[kvch]

The parameter of sd_journal_wait is uint64. Its return value is int.

• https://godoc.org/github.com/coreos/go-systemd/sdjournal#Journal.Wait
• https://manpages.debian.org/testing/libsystemd-dev/sd_journal_wait.3.en.html#RETURN_VALUE

[urso]

This c is not from the call to Wait, but from Next. You even shadow/redefine c when calling Wait.
Sometimes it's a good idea not to shadow/reuse variable names.

See: https://godoc.org/github.com/coreos/go-systemd/sdjournal#Journal.Next

Seems like sdjournal API is somewhat inconsistent here.

How about wrapping Wait, so to reduce the chance of confusion (and reducing complexity in the Next method itself):

func journalWait(j *Journal, dur time.Duration) (has bool, err error) {
  switch c := j.Wait(dur) {
  case sdjournal.SD_JOURNAL_NOP:
    return false, nil
  case sdjournal.SD_JOURNAL_APPEND, sdjournal.SD_JOURNAL_INVALIDATE:
    return true, nil
  default:
    if c < 0 {
 	  return false, fmt.Errorf("error while waiting for event: %+v", syscall.Errno(-c))
    }
    return false, fmt.Errorf("Unknown return code from Wait: %d\n", c)
  }
}

This can be used like:

for {
  ...

  c, err := r.journal.Next()
  if err != nil && err != io.EOF {
    return nil, err
  }
  if c == 0 {
    has, err := journalWait(r.journal, 100 * time.Millisecond)
    if err != nil {
      return nil, err
    }

    if !has {
      continue
    }
  }

  ...
}

Interestingly all other calls on journal properly return error values, but Wait does not. Was Wait added by the original developers or some contributor?
Maybe we can open a PR/issue to enhance consistency in the sdjournal API. And add support for getting the FD itself. Plus expose some other missing functions like sd_journal_process & co.

[urso]

TIL go compiler does not warn/error on not-satisfiable comparisons on uint types: https://play.golang.org/p/g0NFrotaKd-

[urso]

Question: What shall we do if Wait returns an unknown value >0?

1. treat it as error (my sample code) ?
2. treat it like SD_JOURNAL_APPEND (current implementation) ?
3. treat it like SD_JOURNAL_NOP ?

[kvch]

In my implementation (or at least what I intended to implement before messing up with copy-pasting my previous code... :D), an error is logged and nil is returned from Next. Thus, the reader tries to read a new entry again.

[kvch]

Wait seems like it was added later, when sd-journal.h became a dependency.
I would like to open a PR there to add support for the functions we need to check for events without using Wait. (As you proposed it in a previous PR.)

[urso]

This conditional c < 0 is still a no-op, as it will always return false. Let's remove it.

[kvch]

Done.

[kvch]

Failing tests are unrelated.

[kvch]

Follow up issue for testing: #10699
Follow up issue for documentation: #10700

[kvch]

Failing tests are still unrelated.

[kvch]

Failing tests are unrelated.