Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions x-pack/auditbeat/module/system/socket/config.go
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,9 @@ type Config struct {
// EnableIPv6 allows to control IPv6 support. When unset (default) IPv6
// will be automatically detected on runtime.
EnableIPv6 *bool `config:"socket.enable_ipv6"`

// DisableKprobe allows to disable specific kprobes by their probe name.
DisableKprobe []string `config:"socket.disable_kprobe"`
}

// Validate validates the socket metricset config.
Expand Down
8 changes: 7 additions & 1 deletion x-pack/auditbeat/module/system/socket/socket_linux.go
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@
// you may not use this file except in compliance with the Elastic License.

//go:build (linux && 386) || (linux && amd64)
// +build linux,386 linux,amd64

package socket

Expand All @@ -22,6 +21,7 @@ import (
"syscall"
"time"

"golang.org/x/exp/slices"
"golang.org/x/sys/unix"

"github.com/elastic/beats/v7/libbeat/common"
Expand Down Expand Up @@ -405,6 +405,9 @@ func (m *MetricSet) Setup() (err error) {
// Make sure all the required kernel functions are available
//
for _, probeDef := range getKProbes(hasIPv6) {
if slices.Index(m.config.DisableKprobe, probeDef.Probe.Name) != -1 {
continue
}
probeDef = probeDef.ApplyTemplate(m.templateVars)
name := probeDef.Probe.Address
if !m.isKernelFunctionAvailable(name, functions) {
Expand Down Expand Up @@ -454,6 +457,9 @@ func (m *MetricSet) Setup() (err error) {
// Register Kprobes
//
for _, probeDef := range getKProbes(hasIPv6) {
if slices.Index(m.config.DisableKprobe, probeDef.Probe.Name) != -1 {
continue
}
format, decoder, err := m.installer.Install(probeDef)
if err != nil {
return fmt.Errorf("unable to register probe %s: %w", probeDef.Probe.String(), err)
Expand Down