The filebeat utility fails with the following error on the following system: FreeBSD elasticsearch 13.2-STABLE FreeBSD 13.2-STABLE stable/13-n255847-d6fedc3f2d37 GENERIC amd64 Error: root@elasticsearch:/usr/local/etc/beats # filebeat setup Exiting: failed to get host information: unimplemented The filebeat process starts and keeps running but fails to send data to elasticsearch. The process shows problems during a system call. SIGNAL 20 (SIGCHLD) code=CLD_EXITED pid=40496 uid=0 status=1 sigsuspend({ }) ERR#4 'Interrupted system call' wait4(-1,0x0,WNOHANG,0x0) = 40496 (0x9e30) sigreturn(0x3b1948977e40) EJUSTRETURN sigprocmask(SIG_UNBLOCK,{ SIGTERM|SIGCHLD },0x0) = 0 (0x0) sigprocmask(SIG_BLOCK,{ SIGTERM },0x0) = 0 (0x0) nanosleep({ 1.000000000 }) = 0 (0x0) close(5) = 0 (0x0) pipe2(0x3b1948978480,0) = 0 (0x0) fork() = 40516 (0x9e44) sigprocmask(SIG_UNBLOCK,{ SIGTERM },0x0) = 0 (0x0) close(6) = 0 (0x0) __sysctl("kern.proc.args.-1",4,0x0,0x0,0x3b194c370000,40) = 0 (0x0) sigprocmask(SIG_BLOCK,{ SIGTERM|SIGCHLD },0x0) = 0 (0x0) SIGNAL 20 (SIGCHLD) code=CLD_EXITED pid=40516 uid=0 status=1 sigsuspend({ }) ERR#4 'Interrupted system call'
This is due to go-sysinfo lacking FreeBSD support.
Does this make filebeat completely unusable or is there a work-around I can't see? The code that lead to the error doesn't seem to be under any condition, is called in any case.
There's a standing PR waiting for CLA signature: https://github.com/elastic/go-sysinfo/pull/126
Same problem here. How about adding patches still pending on github to the FreeBSD beats port? It looks like the original author abandoned its patches and signing an agreement is required, so waiting for upstream support can last forever.
This problem didn't occur with "beats8-8.7.0_2". Only "beats8-8.8.2_2" is affected.
(In reply to topical from comment #5) Is there a fix to this
(In reply to geedubb14 from comment #6) See comment #3
The patch has been hanging for months because the "contributor license agreement" hasn't been signed. Any chance it can be tossed into a vendor patch in ports if Elastic isn't going to accept it without a annoying legal agreement being signed?
MARKED AS SPAM
(In reply to Sibrody55 from comment #9) There is a problem with go-sysinfo version required by newer beats. And please, do not spam here the URLs we are not interested in. Thanks.
Is there a place I can get the previous release of beats that does work? I am trying to capture logs from a range of devices and I just found this issue and am blocked. Thanks for any help in advance.
(In reply to Jon Catlin from comment #11) You can use sysutils/beats7 instead
beats7 can be an option and works with elasticsearch version 8 in most cases. The beats7 port is not affected by this bug.
yes, the suggestion in #4 makes the most sense. we could keep the patches until whatever happens that will wake up the original author.