-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[SIEM][Auditbeat] Docs for system/socket dataset #13537
Conversation
Pinging @elastic/siem |
3292ac6
to
e1bcdcf
Compare
packets. With TCP, some packets can be received shortly after a socket is | ||
closed. If set too low, additional flows will be generated for those packets. | ||
|
||
- `socket.perf_queue_size` (default: 4096) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not sure if this option and the ones below should be prefixed with a disclaimer or not documented at all.
@@ -21,7 +21,7 @@ type Config struct { | |||
LostQueueSize int `config:"socket.lost_queue_size,min=1"` | |||
|
|||
// ErrQueueSize defines the size of the error queue. A single error is fatal. | |||
ErrQueueSize int `config:"socket.err_buffer_size,min=1"` | |||
ErrQueueSize int `config:"socket.err_queue_size,min=1"` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
renamed this one to align with the rest
[float] | ||
==== Kernel configuration | ||
|
||
A kernel built with the following configuration options enabled is required. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
maybe I'm overdocumenting here
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No, this is good info.
(IPv6 enabled in the loopback device). | ||
|
||
[float] | ||
==== Running on docker |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
is this even useful?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Someone is going to ask this so it's good to anticipate it.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great docs!
|
||
- `socket.perf_queue_size` (default: 4096) | ||
|
||
The number of tracing samples that can be queued for processing. A larger value |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The number of tracing samples that can be queued for processing. A larger value | |
The number of tracing samples that can be queued for processing. A larger value |
@@ -4,3 +4,128 @@ beta[] | |||
|
|||
This is the `socket` dataset of the system module. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Seems like this comment got dropped by Github. Rewriting it...
Can you add an overview of the features this provides (like the selling points). It might be a little redundant with the second paragraph below, but that's ok. Like UDP and TCP flow tracking for ipv4/ipv6, records the user and process associated with the flow, and does not require a kernel module
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done. Please have a look
- Enriches the flows with https://www.elastic.co/guide/en/ecs/current/ecs-process.html[process] | ||
and https://www.elastic.co/guide/en/ecs/current/ecs-user.html[user] information. | ||
- Provides information similar to Packetbeat's flow monitoring with reduced CPU | ||
and memory usage. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I feel like the question "why use this when we have Packetbeat" should be answered but at the same time I'm afraid of making too-bold claims. It has a lesser impact on CPU and memory (and room for improvement), but a more in-depth benchmark is necessary.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
(cherry picked from commit a833e86)
…stic#13556) (cherry picked from commit b37e4ff)
Relates #13058