-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Filebeat] TCP/UDP input cause a panic on Linux under certain conditions #35064
Comments
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
A panic occurred while parsing /proc/net/udp and reaching the final empty line. This occurred on Linux when the desired socket was not found in the list. Fixes elastic#35064
PR to fix: #35068 |
A panic occurred while parsing /proc/net/udp and reaching the final empty line. This occurred on Linux when the desired socket was not found in the list. Fixes #35064
A panic occurred while parsing /proc/net/tcp and reaching the final empty line. This occurred on Linux when the desired socket was not found in the list. Fixes elastic#35064
I found the same bug in the TCP input as well. Fixing it in #35074. |
I am getting panics in filebeat 8.8.0 with the following message:
panic is not occurring in 8.7.1 - so I've downgraded to that. |
Same for me. Was fixed in 8.7.1, broken again in 8.8.0. |
The issue here is a typo in the param name to |
A panic occurred while parsing /proc/net/udp and reaching the final empty line. This occurred on Linux when the desired socket was not found in the list. Fixes #35064
Apologies if I'm just not looking in the right place, do you know if this fix is in the recent v8.8.1 release? I looked here but didn't see it referenced. |
….8.1)" see elastic/beats#35064 (comment) This reverts commit 90a8e1f.
I'm having the same problem with version 8.8.1 on TCP |
@xseth03 This fix will be included in 8.8.2 |
panic stop ... but :
it bothers :) |
@mussi can you provide the config for the udp listener that you have configured? |
i create in inputs.d a file with :
it's one of... i have 26 listen ports my output is for redis. |
@mussi Thanks. I should have said TCP, but you have provided that. The port in that configuration does not agree with the set of addresses in the logs, all the check are for ports 5999, 10303, 10304, 10309, 10312 and 10315, but your config is specifying 514. What do you get if you |
sorry :) :cat /proc/net/tcp6 :cat /proc/net/udp6 |
@mussi Thanks. |
v8.7.0
,main
Steps to Reproduce
The problem
The panic comes from the
procNetUDP
function that gathers some UDP metrics from/proc/net/udp
:beats/filebeat/input/udp/input.go
Lines 256 to 288 in a8dbc6c
It seems some times the data is on a format different than what the function expects.
Workaround
Currently the only know workaround is to downgrade to
v8.6.2
.The text was updated successfully, but these errors were encountered: