From c5f546273912cef47f75fc4831b3d8a59dabff7d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Tue, 5 Feb 2019 20:22:54 +0100 Subject: [PATCH 01/11] add missing syscalls to seccomp policy on amd64 --- journalbeat/include/seccomp_linux_amd64.go | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/journalbeat/include/seccomp_linux_amd64.go b/journalbeat/include/seccomp_linux_amd64.go index 683d3d576c13..f52885573182 100644 --- a/journalbeat/include/seccomp_linux_amd64.go +++ b/journalbeat/include/seccomp_linux_amd64.go @@ -39,6 +39,7 @@ func init() { "access", "arch_prctl", "bind", + "brk", "clock_gettime", "clone", "close", @@ -49,6 +50,7 @@ func init() { "epoll_create1", "epoll_ctl", "epoll_pwait", + "epoll_wait", "exit", "exit_group", "fchdir", @@ -58,12 +60,15 @@ func init() { "fdatasync", "flock", "fstat", + "fstatfs", "fsync", "ftruncate", "futex", "getcwd", "getdents", "getdents64", + "geteuid", + "getgid", "getpeername", "getpid", "getppid", @@ -74,6 +79,10 @@ func init() { "getsockopt", "gettid", "gettimeofday", + "getuid", + "inotify_add_watch", + "inotify_init1", + "inotify_rm_watch", "ioctl", "kill", "listen", @@ -92,7 +101,9 @@ func init() { "pipe", "pipe2", "poll", + "ppoll", "pread64", + "pselect6", "pwrite64", "read", "readlink", @@ -119,6 +130,8 @@ func init() { "socket", "splice", "stat", + "statfs", + "sysinfo", "tgkill", "time", "tkill", @@ -126,6 +139,7 @@ func init() { "unlink", "unlinkat", "wait4", + "waitid", "write", "writev", }, From d38da6ce8615ae5122e602d81e7c6f847231ade7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Tue, 5 Feb 2019 22:15:10 +0100 Subject: [PATCH 02/11] handle waiting for new entries in waitForChange --- journalbeat/reader/journal.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/journalbeat/reader/journal.go b/journalbeat/reader/journal.go index 482aaa83efba..bca4b483997e 100644 --- a/journalbeat/reader/journal.go +++ b/journalbeat/reader/journal.go @@ -206,8 +206,6 @@ func (r *Reader) waitUntilNewEventOrError() (*beat.Event, error) { return nil, nil case c := <-r.changesChan: switch c { - // no changes - case sdjournal.SD_JOURNAL_NOP: // new entries are added or the journal has changed (e.g. vacuum, rotate) case sdjournal.SD_JOURNAL_APPEND, sdjournal.SD_JOURNAL_INVALIDATE: event, err := r.readEvent() @@ -216,11 +214,9 @@ func (r *Reader) waitUntilNewEventOrError() (*beat.Event, error) { } if event == nil { - r.backoff.Wait() continue } - r.backoff.Reset() return event, nil default: if c < 0 { @@ -243,6 +239,12 @@ func (r *Reader) waitForChange() { } c := r.journal.Wait(100 * time.Millisecond) + if c == sdjournal.SD_JOURNAL_NOP { + r.backoff.Wait() + continue + } + r.backoff.Reset() + select { case <-r.done: return From e6e7a63e775beef6fbddfcdc0ef895e9021fe172 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Tue, 5 Feb 2019 22:15:22 +0100 Subject: [PATCH 03/11] cleanup --- journalbeat/reader/journal.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/journalbeat/reader/journal.go b/journalbeat/reader/journal.go index bca4b483997e..dfa940e94e31 100644 --- a/journalbeat/reader/journal.go +++ b/journalbeat/reader/journal.go @@ -259,7 +259,7 @@ func (r *Reader) readEvent() (*beat.Event, error) { return nil, err } - for n == 1 { + if n == 1 { entry, err := r.journal.GetEntry() if err != nil { return nil, err From ae3b7788b99728abdd6556c04d088e495bd08752 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Tue, 5 Feb 2019 23:22:08 +0100 Subject: [PATCH 04/11] fix data race --- journalbeat/input/input.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/journalbeat/input/input.go b/journalbeat/input/input.go index b59d475316a6..70d9bcb6874d 100644 --- a/journalbeat/input/input.go +++ b/journalbeat/input/input.go @@ -189,10 +189,10 @@ func (i *Input) publishAll() { // Stop stops all readers of the input. func (i *Input) Stop() { - i.client.Close() for _, r := range i.readers { r.Close() } + i.client.Close() } // Wait waits until all readers are done. From 71f51075084d975f945f75cd0e86c51af111ba16 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Thu, 7 Feb 2019 10:07:43 +0100 Subject: [PATCH 05/11] fix reading of new entries --- journalbeat/include/seccomp_linux_amd64.go | 2 +- journalbeat/journalbeat.yml | 6 +- journalbeat/reader/journal.go | 103 ++++++--------------- vendor/vendor.json | 8 +- 4 files changed, 37 insertions(+), 82 deletions(-) diff --git a/journalbeat/include/seccomp_linux_amd64.go b/journalbeat/include/seccomp_linux_amd64.go index f52885573182..0f2ee32adc38 100644 --- a/journalbeat/include/seccomp_linux_amd64.go +++ b/journalbeat/include/seccomp_linux_amd64.go @@ -29,7 +29,7 @@ import ( func init() { beat.MustRegisterPolicy(&seccomp.Policy{ - DefaultAction: seccomp.ActionErrno, + DefaultAction: seccomp.ActionLog, Syscalls: []seccomp.SyscallGroup{ { Action: seccomp.ActionAllow, diff --git a/journalbeat/journalbeat.yml b/journalbeat/journalbeat.yml index daa8b40e0e33..c3eba6639a4a 100644 --- a/journalbeat/journalbeat.yml +++ b/journalbeat/journalbeat.yml @@ -24,7 +24,7 @@ journalbeat.inputs: #max_backoff: 20s # Position to start reading from journal. Valid values: head, tail, cursor - seek: cursor + seek: tail # Fallback position if no cursor data is available. #cursor_seek_fallback: head @@ -120,8 +120,8 @@ output.elasticsearch: # Optional protocol and basic auth credentials. #protocol: "https" - #username: "elastic" - #password: "changeme" + username: "elastic" + password: "changeme" #----------------------------- Logstash output -------------------------------- #output.logstash: diff --git a/journalbeat/reader/journal.go b/journalbeat/reader/journal.go index dfa940e94e31..7c082ca32a0e 100644 --- a/journalbeat/reader/journal.go +++ b/journalbeat/reader/journal.go @@ -42,12 +42,11 @@ import ( // Reader reads entries from journal(s). type Reader struct { - journal *sdjournal.Journal - config Config - done chan struct{} - logger *logp.Logger - backoff backoff.Backoff - changesChan chan int + journal *sdjournal.Journal + config Config + done chan struct{} + logger *logp.Logger + backoff backoff.Backoff } // New creates a new journal reader and moves the FP to the configured position. @@ -97,21 +96,16 @@ func newReader(logger *logp.Logger, done chan struct{}, c Config, journal *sdjou } r := &Reader{ - journal: journal, - config: c, - done: done, - logger: logger, - backoff: backoff.NewExpBackoff(done, c.Backoff, c.MaxBackoff), - changesChan: make(chan int), + journal: journal, + config: c, + done: done, + logger: logger, + backoff: backoff.NewExpBackoff(done, c.Backoff, c.MaxBackoff), } r.seek(state.Cursor) instance.AddJournalToMonitor(c.Path, journal) - // waiting for journal changes are done in a separate gorountine - // when the reader is closed, it is stopped - go r.waitForChange() - return r, nil } @@ -188,36 +182,31 @@ func (r *Reader) seek(cursor string) { // Next waits until a new event shows up and returns it. // It blocks until an event is returned or an error occurs. func (r *Reader) Next() (*beat.Event, error) { - event, err := r.readEvent() - if err != nil { - return nil, err - } - if event != nil { - return event, nil - } - - return r.waitUntilNewEventOrError() -} - -func (r *Reader) waitUntilNewEventOrError() (*beat.Event, error) { for { select { case <-r.done: return nil, nil - case c := <-r.changesChan: + default: + } + + c, err := r.journal.Next() + if err != nil && err != io.EOF { + return nil, err + } + + // error while reading next entry + if c < 0 { + return nil, fmt.Errorf("error while reading next entry %+v", syscall.Errno(-c)) + } + + // no new entry, so wait + if c == 0 { + c := r.journal.Wait(100 * time.Millisecond) switch c { + case sdjournal.SD_JOURNAL_NOP: + continue // new entries are added or the journal has changed (e.g. vacuum, rotate) case sdjournal.SD_JOURNAL_APPEND, sdjournal.SD_JOURNAL_INVALIDATE: - event, err := r.readEvent() - if err != nil { - return nil, err - } - - if event == nil { - continue - } - - return event, nil default: if c < 0 { return nil, fmt.Errorf("error while waiting for event: %+v", syscall.Errno(-c)) @@ -226,48 +215,15 @@ func (r *Reader) waitUntilNewEventOrError() (*beat.Event, error) { r.logger.Errorf("Unknown return code from Wait: %d\n", c) } } - } -} -func (r *Reader) waitForChange() { - for { - // try to return before waiting for event - select { - case <-r.done: - return - default: - } - - c := r.journal.Wait(100 * time.Millisecond) - if c == sdjournal.SD_JOURNAL_NOP { - r.backoff.Wait() - continue - } - r.backoff.Reset() - - select { - case <-r.done: - return - case r.changesChan <- c: - } - } -} - -func (r *Reader) readEvent() (*beat.Event, error) { - n, err := r.journal.Next() - if err != nil && err != io.EOF { - return nil, err - } - - if n == 1 { entry, err := r.journal.GetEntry() if err != nil { return nil, err } event := r.toEvent(entry) + return event, nil } - return nil, nil } // toEvent creates a beat.Event from journal entries. @@ -323,5 +279,4 @@ func (r *Reader) convertNamedField(fc fieldConversion, value string) interface{} func (r *Reader) Close() { instance.StopMonitoringJournal(r.config.Path) r.journal.Close() - close(r.changesChan) } diff --git a/vendor/vendor.json b/vendor/vendor.json index 221a06217dda..d858864327a1 100644 --- a/vendor/vendor.json +++ b/vendor/vendor.json @@ -498,10 +498,10 @@ { "checksumSHA1": "cEszpxh1szqTb440ze4hm/Vfm40=", "path": "github.com/coreos/go-systemd/sdjournal", - "revision": "39ca1b05acc7ad1220e09f133283b8859a8b71ab", - "revisionTime": "2018-05-11T13:34:05Z", - "version": "v17", - "versionExact": "v17" + "revision": "9002847aa1425fb6ac49077c0a630b3b67e0fbfd", + "revisionTime": "2018-10-31T08:50:51Z", + "version": "v18", + "versionExact": "v18" }, { "checksumSHA1": "nwll5KjH9SKrWxB45OmN09wdipI=", From 2d1fc338c3ee6d5aab074dfe12a13e367bddf879 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Tue, 12 Feb 2019 10:40:03 +0100 Subject: [PATCH 06/11] add new syscalls to common seccomp policy --- journalbeat/include/seccomp_linux_386.go | 122 --------------- journalbeat/include/seccomp_linux_amd64.go | 149 ------------------- libbeat/common/seccomp/policy_linux_amd64.go | 4 + 3 files changed, 4 insertions(+), 271 deletions(-) delete mode 100644 journalbeat/include/seccomp_linux_386.go delete mode 100644 journalbeat/include/seccomp_linux_amd64.go diff --git a/journalbeat/include/seccomp_linux_386.go b/journalbeat/include/seccomp_linux_386.go deleted file mode 100644 index a22b1e2e4fd4..000000000000 --- a/journalbeat/include/seccomp_linux_386.go +++ /dev/null @@ -1,122 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -// Code generated by seccomp-profiler - DO NOT EDIT. - -// +build linux,386 - -package include - -import ( - "github.com/elastic/go-seccomp-bpf" - - beat "github.com/elastic/beats/libbeat/common/seccomp" -) - -func init() { - beat.MustRegisterPolicy(&seccomp.Policy{ - DefaultAction: seccomp.ActionErrno, - Syscalls: []seccomp.SyscallGroup{ - { - Action: seccomp.ActionAllow, - Names: []string{ - "_llseek", - "access", - "brk", - "clock_gettime", - "clone", - "close", - "dup", - "dup2", - "epoll_create", - "epoll_create1", - "epoll_ctl", - "epoll_wait", - "exit", - "exit_group", - "fchdir", - "fchmod", - "fchown32", - "fcntl", - "fcntl64", - "fdatasync", - "flock", - "fstat64", - "fsync", - "ftruncate64", - "futex", - "getcwd", - "getdents", - "getdents64", - "getpid", - "getppid", - "getrandom", - "getrlimit", - "getrusage", - "gettid", - "gettimeofday", - "ioctl", - "kill", - "lstat64", - "madvise", - "mincore", - "mkdirat", - "mmap2", - "mprotect", - "munmap", - "nanosleep", - "open", - "openat", - "pipe", - "pipe2", - "poll", - "pread64", - "prlimit64", - "pwrite64", - "read", - "readlink", - "readlinkat", - "rename", - "renameat", - "rt_sigaction", - "rt_sigprocmask", - "rt_sigreturn", - "sched_getaffinity", - "sched_yield", - "sendfile64", - "set_robust_list", - "set_thread_area", - "setitimer", - "sigaltstack", - "socketcall", - "splice", - "stat", - "stat64", - "tgkill", - "time", - "tkill", - "uname", - "unlink", - "unlinkat", - "wait4", - "write", - "writev", - }, - }, - }, - }) -} diff --git a/journalbeat/include/seccomp_linux_amd64.go b/journalbeat/include/seccomp_linux_amd64.go deleted file mode 100644 index 0f2ee32adc38..000000000000 --- a/journalbeat/include/seccomp_linux_amd64.go +++ /dev/null @@ -1,149 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -// Code generated by seccomp-profiler - DO NOT EDIT. - -// +build linux,amd64 - -package include - -import ( - "github.com/elastic/go-seccomp-bpf" - - beat "github.com/elastic/beats/libbeat/common/seccomp" -) - -func init() { - beat.MustRegisterPolicy(&seccomp.Policy{ - DefaultAction: seccomp.ActionLog, - Syscalls: []seccomp.SyscallGroup{ - { - Action: seccomp.ActionAllow, - Names: []string{ - "accept", - "accept4", - "access", - "arch_prctl", - "bind", - "brk", - "clock_gettime", - "clone", - "close", - "connect", - "dup", - "dup2", - "epoll_create", - "epoll_create1", - "epoll_ctl", - "epoll_pwait", - "epoll_wait", - "exit", - "exit_group", - "fchdir", - "fchmod", - "fchown", - "fcntl", - "fdatasync", - "flock", - "fstat", - "fstatfs", - "fsync", - "ftruncate", - "futex", - "getcwd", - "getdents", - "getdents64", - "geteuid", - "getgid", - "getpeername", - "getpid", - "getppid", - "getrandom", - "getrlimit", - "getrusage", - "getsockname", - "getsockopt", - "gettid", - "gettimeofday", - "getuid", - "inotify_add_watch", - "inotify_init1", - "inotify_rm_watch", - "ioctl", - "kill", - "listen", - "lseek", - "lstat", - "madvise", - "mincore", - "mkdirat", - "mmap", - "mprotect", - "munmap", - "nanosleep", - "newfstatat", - "open", - "openat", - "pipe", - "pipe2", - "poll", - "ppoll", - "pread64", - "pselect6", - "pwrite64", - "read", - "readlink", - "readlinkat", - "recvfrom", - "recvmmsg", - "recvmsg", - "rename", - "renameat", - "rt_sigaction", - "rt_sigprocmask", - "rt_sigreturn", - "sched_getaffinity", - "sched_yield", - "sendfile", - "sendmmsg", - "sendmsg", - "sendto", - "set_robust_list", - "setitimer", - "setsockopt", - "shutdown", - "sigaltstack", - "socket", - "splice", - "stat", - "statfs", - "sysinfo", - "tgkill", - "time", - "tkill", - "uname", - "unlink", - "unlinkat", - "wait4", - "waitid", - "write", - "writev", - }, - }, - }, - }) -} diff --git a/libbeat/common/seccomp/policy_linux_amd64.go b/libbeat/common/seccomp/policy_linux_amd64.go index 00e5353b4f9c..a131e7f3c344 100644 --- a/libbeat/common/seccomp/policy_linux_amd64.go +++ b/libbeat/common/seccomp/policy_linux_amd64.go @@ -54,6 +54,7 @@ func init() { "fdatasync", "flock", "fstat", + "fstatfs", "fsync", "ftruncate", "futex", @@ -66,6 +67,7 @@ func init() { "getpid", "getppid", "getrandom", + "getrlimit", "getrusage", "getsockname", "getsockopt", @@ -93,6 +95,7 @@ func init() { "pipe", "pipe2", "poll", + "ppoll", "pread64", "pselect6", "pwrite64", @@ -119,6 +122,7 @@ func init() { "shutdown", "sigaltstack", "socket", + "splice", "stat", "statfs", "sysinfo", From f305e7a6aed541e13e94faea4ed517d0d4b86ac6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Tue, 12 Feb 2019 10:40:58 +0100 Subject: [PATCH 07/11] fix config --- journalbeat/journalbeat.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/journalbeat/journalbeat.yml b/journalbeat/journalbeat.yml index c3eba6639a4a..daa8b40e0e33 100644 --- a/journalbeat/journalbeat.yml +++ b/journalbeat/journalbeat.yml @@ -24,7 +24,7 @@ journalbeat.inputs: #max_backoff: 20s # Position to start reading from journal. Valid values: head, tail, cursor - seek: tail + seek: cursor # Fallback position if no cursor data is available. #cursor_seek_fallback: head @@ -120,8 +120,8 @@ output.elasticsearch: # Optional protocol and basic auth credentials. #protocol: "https" - username: "elastic" - password: "changeme" + #username: "elastic" + #password: "changeme" #----------------------------- Logstash output -------------------------------- #output.logstash: From 84cdb6e7b2cc3d7598cf3a6de34a55b64c3ada9f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Tue, 12 Feb 2019 11:16:18 +0100 Subject: [PATCH 08/11] update notice --- NOTICE.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/NOTICE.txt b/NOTICE.txt index 07145abc5741..56fa8db63e20 100644 --- a/NOTICE.txt +++ b/NOTICE.txt @@ -241,8 +241,8 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -------------------------------------------------------------------- Dependency: github.com/coreos/go-systemd -Version: v17 -Revision: 39ca1b05acc7ad1220e09f133283b8859a8b71ab +Version: v18 +Revision: 9002847aa1425fb6ac49077c0a630b3b67e0fbfd License type (autodetected): Apache-2.0 ./vendor/github.com/coreos/go-systemd/LICENSE: -------------------------------------------------------------------- From 5c235f9c3fab95171bcdcbef7d74c425637c5d42 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Tue, 12 Feb 2019 16:36:31 +0100 Subject: [PATCH 09/11] add known issue to list --- CHANGELOG.next.asciidoc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 3a7136a63057..fada34410352 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -357,4 +357,6 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d ==== Known Issue +*Journalbeat* +- Journalbeat requires at least systemd v233 in order to follow entries after journal changes (rotation, vacuum). From b679db7929f61af0b4c61fefee8bf6991cf22d45 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Wed, 13 Feb 2019 09:42:26 +0100 Subject: [PATCH 10/11] fix refactoring of wait --- journalbeat/reader/journal.go | 35 ++++++++++++++++++++++++----------- 1 file changed, 24 insertions(+), 11 deletions(-) diff --git a/journalbeat/reader/journal.go b/journalbeat/reader/journal.go index 7c082ca32a0e..2085be2e1484 100644 --- a/journalbeat/reader/journal.go +++ b/journalbeat/reader/journal.go @@ -201,18 +201,12 @@ func (r *Reader) Next() (*beat.Event, error) { // no new entry, so wait if c == 0 { - c := r.journal.Wait(100 * time.Millisecond) - switch c { - case sdjournal.SD_JOURNAL_NOP: + hasNewEntry, err := r.checkForNewEvents() + if err != nil { + return nil, err + } + if !hasNewEntry { continue - // new entries are added or the journal has changed (e.g. vacuum, rotate) - case sdjournal.SD_JOURNAL_APPEND, sdjournal.SD_JOURNAL_INVALIDATE: - default: - if c < 0 { - return nil, fmt.Errorf("error while waiting for event: %+v", syscall.Errno(-c)) - } - - r.logger.Errorf("Unknown return code from Wait: %d\n", c) } } @@ -226,6 +220,25 @@ func (r *Reader) Next() (*beat.Event, error) { } } +func (r *Reader) checkForNewEvents() (bool, error) { + c := r.journal.Wait(100 * time.Millisecond) + switch c { + case sdjournal.SD_JOURNAL_NOP: + return false, nil + // new entries are added or the journal has changed (e.g. vacuum, rotate) + case sdjournal.SD_JOURNAL_APPEND, sdjournal.SD_JOURNAL_INVALIDATE: + return true, nil + default: + } + + if c < 0 { + return false, fmt.Errorf("error while waiting for event: %+v", syscall.Errno(-c)) + } + + r.logger.Errorf("Unknown return code from Wait: %d\n", c) + return false, nil +} + // toEvent creates a beat.Event from journal entries. func (r *Reader) toEvent(entry *sdjournal.JournalEntry) *beat.Event { fields := common.MapStr{} From eac3139022eca73e1da2ff694731c7bb0e6bc841 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Thu, 14 Feb 2019 11:17:20 +0100 Subject: [PATCH 11/11] rm noop --- journalbeat/reader/journal.go | 4 ---- 1 file changed, 4 deletions(-) diff --git a/journalbeat/reader/journal.go b/journalbeat/reader/journal.go index 2085be2e1484..fac946110200 100644 --- a/journalbeat/reader/journal.go +++ b/journalbeat/reader/journal.go @@ -231,10 +231,6 @@ func (r *Reader) checkForNewEvents() (bool, error) { default: } - if c < 0 { - return false, fmt.Errorf("error while waiting for event: %+v", syscall.Errno(-c)) - } - r.logger.Errorf("Unknown return code from Wait: %d\n", c) return false, nil }