Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Deprecate procfs backend for add_session_metadata #42934

Open
2 tasks
fearful-symmetry opened this issue Feb 26, 2025 · 1 comment
Open
2 tasks

Deprecate procfs backend for add_session_metadata #42934

fearful-symmetry opened this issue Feb 26, 2025 · 1 comment
Labels
Team:Security-Linux Platform Linux Platform Team in Security Solution

Comments

@fearful-symmetry
Copy link
Contributor

As recently demonstrated here (#42398), the procfs backend for the session metadata processor is extremely prone to data loss by nature of its design, and the kprobe-based backend generally works better for most things.

However, we need some kind of strategy for actually deprecating this, since its still used as a fallback, and is probably seeing some amount of use on systems where permission issues prevent the kprobe backend from starting up. We need some kind of documentation, most likely geared towards k8s/docker users, telling them what permissions switches to flip in order to get the kprobe backend working.

There's two steps to this:

  • Figure out what docs we need, and write them
  • Add a deprecation warning message to the procfs backend
@fearful-symmetry fearful-symmetry added the Team:Security-Linux Platform Linux Platform Team in Security Solution label Feb 26, 2025
@elasticmachine
Copy link
Collaborator

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

@andrewkroh andrewkroh changed the title Depricate procfs backend for add_session_metadata Deprecate procfs backend for add_session_metadata Feb 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Team:Security-Linux Platform Linux Platform Team in Security Solution
Projects
None yet
Development

No branches or pull requests

2 participants