Small comment

x-pack/auditbeat/tracing/cpu.go

@@ -29,7 +29,12 @@ const (
 	// PresentCPUsPath is the path to the system file listing the CPUs that are identified as present.
 	PresentCPUsPath = "/sys/devices/system/cpu/present"
 
-	// See `Documentation/admin-guide/cputopology.rst` in the Linux kernel docs for more information.
+	// See `Documentation/admin-guide/cputopology.rst` in the Linux kernel docs for more information
+	// on the above files.
+
+	// IsolatedCPUsPath is only present when CPU isolation is active, for example using the `isolcpus`
+	// kernel argument.
+	IsolatedCPUsPath = "/sys/devices/system/cpu/isolated"
 )
 
 // CPUSet represents a group of CPUs.

x-pack/auditbeat/tracing/perfevent.go

@@ -110,6 +110,12 @@ func NewPerfChannel(cfg ...PerfChannelConf) (channel *PerfChannel, err error) {
 	channel.attr.SetSamplePeriod(1)
 	channel.attr.SetWakeupEvents(1)
 
+	// Load the list of online CPUs from /sys/devices/system/cpu/online.
+	// This is necessary in order to to install each kprobe on all online CPUs.
+	//
+	// Note:
+	// There's currently no mechanism to adapt to CPUs being added or removed
+	// at runtime (CPU hotplug).
 	channel.cpus, err = NewCPUSetFromFile(OnlineCPUsPath)
 	if err != nil {
 		return nil, errors.Wrap(err, "error listing online CPUs")