Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SIEM][Auditbeat] Docs for system/socket dataset #13537

Merged
merged 3 commits into from
Sep 9, 2019

Conversation

adriansr
Copy link
Contributor

@adriansr adriansr commented Sep 6, 2019

Relates #13058

@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem

packets. With TCP, some packets can be received shortly after a socket is
closed. If set too low, additional flows will be generated for those packets.

- `socket.perf_queue_size` (default: 4096)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure if this option and the ones below should be prefixed with a disclaimer or not documented at all.

@@ -21,7 +21,7 @@ type Config struct {
LostQueueSize int `config:"socket.lost_queue_size,min=1"`

// ErrQueueSize defines the size of the error queue. A single error is fatal.
ErrQueueSize int `config:"socket.err_buffer_size,min=1"`
ErrQueueSize int `config:"socket.err_queue_size,min=1"`
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

renamed this one to align with the rest

[float]
==== Kernel configuration

A kernel built with the following configuration options enabled is required.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe I'm overdocumenting here

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, this is good info.

(IPv6 enabled in the loopback device).

[float]
==== Running on docker
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this even useful?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Someone is going to ask this so it's good to anticipate it.

Copy link
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great docs!


- `socket.perf_queue_size` (default: 4096)

The number of tracing samples that can be queued for processing. A larger value
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The number of tracing samples that can be queued for processing. A larger value
The number of tracing samples that can be queued for processing. A larger value

@@ -4,3 +4,128 @@ beta[]

This is the `socket` dataset of the system module.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like this comment got dropped by Github. Rewriting it...

Can you add an overview of the features this provides (like the selling points). It might be a little redundant with the second paragraph below, but that's ok. Like UDP and TCP flow tracking for ipv4/ipv6, records the user and process associated with the flow, and does not require a kernel module

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done. Please have a look

- Enriches the flows with https://www.elastic.co/guide/en/ecs/current/ecs-process.html[process]
and https://www.elastic.co/guide/en/ecs/current/ecs-user.html[user] information.
- Provides information similar to Packetbeat's flow monitoring with reduced CPU
and memory usage.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel like the question "why use this when we have Packetbeat" should be answered but at the same time I'm afraid of making too-bold claims. It has a lesser impact on CPU and memory (and room for improvement), but a more in-depth benchmark is necessary.

Copy link
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@andrewkroh andrewkroh added the needs_backport PR is waiting to be backported to other branches. label Sep 9, 2019
@adriansr adriansr merged commit a833e86 into elastic:master Sep 9, 2019
adriansr added a commit to adriansr/beats that referenced this pull request Sep 9, 2019
@adriansr adriansr added v7.4.0 and removed needs_backport PR is waiting to be backported to other branches. labels Sep 9, 2019
adriansr added a commit that referenced this pull request Sep 10, 2019
leweafan pushed a commit to leweafan/beats that referenced this pull request Apr 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants