[Auditbeat] Log error when Homebrew not installed (#11667) (#11948)

Change `package` dataset on macOS to logging an error when Homebrew is not installed instead of failing to start altogether. It will keep checking and start sending events as usual in case Homebrew is installed later.

(cherry picked from commit bbe4991)

CHANGELOG.next.asciidoc

@@ -37,6 +37,8 @@ https://github.com/elastic/beats/compare/v7.0.0...7.0[Check the HEAD diff]
 
 *Auditbeat*
 
+- Package dataset: Log error when Homebrew is not installed. {pull}11667[11667]
+
 *Filebeat*
 
 *Heartbeat*

x-pack/auditbeat/module/system/package/package.go

@@ -43,8 +43,7 @@ const (
 	debian = "debian"
 	darwin = "darwin"
 
-	dpkgStatusFile     = "/var/lib/dpkg/status"
-	homebrewCellarPath = "/usr/local/Cellar"
+	dpkgStatusFile = "/var/lib/dpkg/status"
 
 	bucketName              = "package.v1"
 	bucketKeyPackages       = "packages"
@@ -54,6 +53,10 @@ const (
 	eventTypeEvent = "event"
 )
 
+var (
+	homebrewCellarPath = "/usr/local/Cellar"
+)
+
 type eventAction uint8
 
 const (
@@ -216,7 +219,7 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 		}
 	case darwin:
 		if _, err := os.Stat(homebrewCellarPath); err != nil {
-			return nil, errors.Wrapf(err, "error looking up %s - is Homebrew installed?", homebrewCellarPath)
+			ms.log.Errorf("Homebrew does not seem to be installed. Will keep trying. Error: %v", err)
 		}
 	default:
 		return nil, fmt.Errorf("this metricset does not support OS family %v", osInfo.Family)
@@ -261,8 +264,8 @@ func (ms *MetricSet) Close() error {
 // Fetch collects data about the host. It is invoked periodically.
 func (ms *MetricSet) Fetch(report mb.ReporterV2) {
 	needsStateUpdate := time.Since(ms.lastState) > ms.config.effectiveStatePeriod()
-	if needsStateUpdate || ms.cache.IsEmpty() {
-		ms.log.Debugf("State update needed (needsStateUpdate=%v, cache.IsEmpty()=%v)", needsStateUpdate, ms.cache.IsEmpty())
+	if needsStateUpdate {
+		ms.log.Debug("Sending state")
 		err := ms.reportState(report)
 		if err != nil {
 			ms.log.Error(err)
@@ -282,7 +285,7 @@ func (ms *MetricSet) Fetch(report mb.ReporterV2) {
 func (ms *MetricSet) reportState(report mb.ReporterV2) error {
 	ms.lastState = time.Now()
 
-	packages, err := getPackages(ms.osFamily)
+	packages, err := ms.getPackages(ms.osFamily)
 	if err != nil {
 		return errors.Wrap(err, "failed to get packages")
 	}
@@ -316,7 +319,7 @@ func (ms *MetricSet) reportState(report mb.ReporterV2) error {
 
 // reportChanges detects and reports any changes to installed packages on this system since the last call.
 func (ms *MetricSet) reportChanges(report mb.ReporterV2) error {
-	packages, err := getPackages(ms.osFamily)
+	packages, err := ms.getPackages(ms.osFamily)
 	if err != nil {
 		return errors.Wrap(err, "failed to get packages")
 	}
@@ -470,28 +473,32 @@ func (ms *MetricSet) savePackagesToDisk(packages []*Package) error {
 	return nil
 }
 
-func getPackages(osFamily string) (packages []*Package, err error) {
+func (ms *MetricSet) getPackages(osFamily string) (packages []*Package, err error) {
 	switch osFamily {
 	case redhat, suse:
 		packages, err = listRPMPackages()
 		if err != nil {
-			err = errors.Wrap(err, "error getting RPM packages")
+			return nil, errors.Wrap(err, "error getting RPM packages")
 		}
 	case debian:
 		packages, err = listDebPackages()
 		if err != nil {
-			err = errors.Wrap(err, "error getting DEB packages")
+			return nil, errors.Wrap(err, "error getting DEB packages")
 		}
 	case darwin:
 		packages, err = listBrewPackages()
 		if err != nil {
-			err = errors.Wrap(err, "error getting Homebrew packages")
+			if os.IsNotExist(err) {
+				ms.log.Debugf("Homebrew not installed: %v", err)
+			} else {
+				return nil, errors.Wrap(err, "error getting Homebrew packages")
+			}
 		}
 	default:
-		err = errors.Errorf("unknown OS %v - this should not have happened", osFamily)
+		return nil, errors.Errorf("unknown OS %v - this should not have happened", osFamily)
 	}
 
-	return
+	return packages, nil
 }
 
 func listDebPackages() ([]*Package, error) {

x-pack/auditbeat/module/system/package/package_homebrew.go

@@ -30,7 +30,7 @@ type InstallReceipt struct {
 func listBrewPackages() ([]*Package, error) {
 	packageDirs, err := ioutil.ReadDir(homebrewCellarPath)
 	if err != nil {
-		return nil, errors.Wrapf(err, "error reading directory %s", homebrewCellarPath)
+		return nil, err
 	}
 
 	var packages []*Package

x-pack/auditbeat/module/system/package/package_homebrew_test.go

@@ -0,0 +1,97 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+// +build !windows
+
+package pkg
+
+import (
+	"os"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/elastic/beats/auditbeat/core"
+	abtest "github.com/elastic/beats/auditbeat/testing"
+	"github.com/elastic/beats/libbeat/beat"
+	mbtest "github.com/elastic/beats/metricbeat/mb/testing"
+)
+
+func TestHomebrew(t *testing.T) {
+	defer abtest.SetupDataDir(t)()
+
+	oldPath := homebrewCellarPath
+	defer func() {
+		homebrewCellarPath = oldPath
+	}()
+	homebrewCellarPath = "testdata/homebrew/"
+
+	// Test just listBrewPackages()
+	packages, err := listBrewPackages()
+	assert.NoError(t, err)
+	if assert.Len(t, packages, 1) {
+		pkg := packages[0]
+		assert.Equal(t, "test-package", pkg.Name)
+		assert.Equal(t, "Test package", pkg.Summary)
+		assert.Equal(t, "https://www.elastic.co/", pkg.URL)
+		assert.Equal(t, "1.0.0", pkg.Version)
+	}
+
+	// Test whole dataset if on Darwin
+	if runtime.GOOS == "darwin" {
+		f := mbtest.NewReportingMetricSetV2(t, getConfig())
+		defer f.(*MetricSet).bucket.DeleteBucket()
+
+		events, errs := mbtest.ReportingFetchV2(f)
+		if len(errs) > 0 {
+			t.Fatalf("received error: %+v", errs[0])
+		}
+
+		if assert.Len(t, events, 1) {
+			event := mbtest.StandardizeEvent(f, events[0], core.AddDatasetToEvent)
+			checkFieldValue(t, event, "system.audit.package.name", "test-package")
+			checkFieldValue(t, event, "system.audit.package.summary", "Test package")
+			checkFieldValue(t, event, "system.audit.package.url", "https://www.elastic.co/")
+			checkFieldValue(t, event, "system.audit.package.version", "1.0.0")
+			checkFieldValue(t, event, "system.audit.package.entity_id", "Krm421rtYM4wgq1S")
+		}
+	}
+}
+
+func checkFieldValue(t *testing.T, event beat.Event, fieldName string, fieldValue interface{}) {
+	value, err := event.GetValue(fieldName)
+	if assert.NoError(t, err) {
+		assert.Equal(t, fieldValue, value)
+	}
+}
+
+func TestHomebrewNotExist(t *testing.T) {
+	defer abtest.SetupDataDir(t)()
+
+	oldPath := homebrewCellarPath
+	defer func() {
+		homebrewCellarPath = oldPath
+	}()
+	homebrewCellarPath = "/does/not/exist"
+
+	// Test just listBrewPackages()
+	packages, err := listBrewPackages()
+	if assert.Error(t, err) {
+		assert.True(t, os.IsNotExist(err), "Unexpected error %v", err)
+	}
+	assert.Empty(t, packages)
+
+	// Test whole dataset if on Darwin
+	if runtime.GOOS == "darwin" {
+		f := mbtest.NewReportingMetricSetV2(t, getConfig())
+		defer f.(*MetricSet).bucket.DeleteBucket()
+
+		events, errs := mbtest.ReportingFetchV2(f)
+		if len(errs) > 0 {
+			t.Fatalf("received error: %+v", errs[0])
+		}
+		assert.Empty(t, events)
+	}
+}

x-pack/auditbeat/module/system/package/testdata/homebrew/test-package/1.0.0/.brew/test-package.rb

@@ -0,0 +1,4 @@
+class Test < Formula
+  desc "Test package"
+  homepage "https://www.elastic.co/"
+end

x-pack/auditbeat/module/system/package/testdata/homebrew/test-package/1.0.0/INSTALL_RECEIPT.json

@@ -0,0 +1 @@
+{"homebrew_version":"1.6.7-44-g1bfec50","used_options":[],"unused_options":["--without-cgo","--without-race"],"built_as_bottle":true,"poured_from_bottle":true,"installed_as_dependency":false,"installed_on_request":true,"changed_files":["INSTALL_RECEIPT.json","libexec/pkg/bootstrap/src/bootstrap/cmd/cgo/doc.go","libexec/src/cmd/cgo/doc.go","libexec/src/cmd/vendor/golang.org/x/arch/arm/armasm/objdumpext_test.go","libexec/src/crypto/x509/root_bsd.go","libexec/src/crypto/x509/root_unix.go","libexec/src/mime/type_dragonfly.go","libexec/src/mime/type_freebsd.go","libexec/src/net/http/cgi/host.go","libexec/src/path/filepath/example_unix_test.go"],"time":1533834877,"source_modified_time":1528329050,"HEAD":null,"stdlib":null,"compiler":"clang","aliases":["google-go","golang","go@1.10"],"runtime_dependencies":[],"source":{"path":"","tap":"homebrew/core","spec":"stable","versions":{"stable":"1.10.3","devel":"","head":"HEAD","version_scheme":0}}}