[Auditbeat] Log error when Homebrew not installed

CHANGELOG.next.asciidoc

@@ -73,6 +73,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 
 - Package dataset: dlopen versioned librpm shared objects. {pull}11565[11565]
 - Package dataset: Nullify Librpm's rpmsqEnable. {pull}11628[11628]
+- Package dataset: Log error when Homebrew is not installed. {pull}11667[11667]
 
 *Filebeat*
 

x-pack/auditbeat/module/system/package/package.go

@@ -43,8 +43,7 @@ const (
 	debian = "debian"
 	darwin = "darwin"
 
-	dpkgStatusFile     = "/var/lib/dpkg/status"
-	homebrewCellarPath = "/usr/local/Cellar"
+	dpkgStatusFile = "/var/lib/dpkg/status"
 
 	bucketName              = "package.v1"
 	bucketKeyPackages       = "packages"
@@ -54,6 +53,10 @@ const (
 	eventTypeEvent = "event"
 )
 
+var (
+	homebrewCellarPath = "/usr/local/Cellar"
+)
+
 type eventAction uint8
 
 const (
@@ -216,7 +219,7 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 		}
 	case darwin:
 		if _, err := os.Stat(homebrewCellarPath); err != nil {
-			return nil, errors.Wrapf(err, "error looking up %s - is Homebrew installed?", homebrewCellarPath)
+			ms.log.Errorf("Homebrew does not seem to be installed. Will keep trying. Error: %v", err)
 		}
 	default:
 		return nil, fmt.Errorf("this metricset does not support OS family %v", osInfo.Family)
@@ -261,8 +264,8 @@ func (ms *MetricSet) Close() error {
 // Fetch collects data about the host. It is invoked periodically.
 func (ms *MetricSet) Fetch(report mb.ReporterV2) {
 	needsStateUpdate := time.Since(ms.lastState) > ms.config.effectiveStatePeriod()
-	if needsStateUpdate || ms.cache.IsEmpty() {
-		ms.log.Debugf("State update needed (needsStateUpdate=%v, cache.IsEmpty()=%v)", needsStateUpdate, ms.cache.IsEmpty())
+	if needsStateUpdate {
+		ms.log.Debug("Sending state")
 		err := ms.reportState(report)
 		if err != nil {
 			ms.log.Error(err)
@@ -282,7 +285,7 @@ func (ms *MetricSet) Fetch(report mb.ReporterV2) {
 func (ms *MetricSet) reportState(report mb.ReporterV2) error {
 	ms.lastState = time.Now()
 
-	packages, err := getPackages(ms.osFamily)
+	packages, err := ms.getPackages(ms.osFamily)
 	if err != nil {
 		return errors.Wrap(err, "failed to get packages")
 	}
@@ -316,7 +319,7 @@ func (ms *MetricSet) reportState(report mb.ReporterV2) error {
 
 // reportChanges detects and reports any changes to installed packages on this system since the last call.
 func (ms *MetricSet) reportChanges(report mb.ReporterV2) error {
-	packages, err := getPackages(ms.osFamily)
+	packages, err := ms.getPackages(ms.osFamily)
 	if err != nil {
 		return errors.Wrap(err, "failed to get packages")
 	}
@@ -470,28 +473,32 @@ func (ms *MetricSet) savePackagesToDisk(packages []*Package) error {
 	return nil
 }
 
-func getPackages(osFamily string) (packages []*Package, err error) {
+func (ms *MetricSet) getPackages(osFamily string) (packages []*Package, err error) {
 	switch osFamily {
 	case redhat, suse:
 		packages, err = listRPMPackages()
 		if err != nil {
-			err = errors.Wrap(err, "error getting RPM packages")
+			return nil, errors.Wrap(err, "error getting RPM packages")
 		}
 	case debian:
 		packages, err = listDebPackages()
 		if err != nil {
-			err = errors.Wrap(err, "error getting DEB packages")
+			return nil, errors.Wrap(err, "error getting DEB packages")
 		}
 	case darwin:
 		packages, err = listBrewPackages()
 		if err != nil {
-			err = errors.Wrap(err, "error getting Homebrew packages")
+			if os.IsNotExist(err) {
+				ms.log.Debugf("Homebrew not installed: %v", err)
+			} else {
+				return nil, errors.Wrap(err, "error getting Homebrew packages")
+			}
 		}
 	default:
-		err = errors.Errorf("unknown OS %v - this should not have happened", osFamily)
+		return nil, errors.Errorf("unknown OS %v - this should not have happened", osFamily)
 	}
 
-	return
+	return packages, nil
 }
 
 func listDebPackages() ([]*Package, error) {

x-pack/auditbeat/module/system/package/package_homebrew.go

@@ -30,7 +30,7 @@ type InstallReceipt struct {
 func listBrewPackages() ([]*Package, error) {
 	packageDirs, err := ioutil.ReadDir(homebrewCellarPath)
 	if err != nil {
-		return nil, errors.Wrapf(err, "error reading directory %s", homebrewCellarPath)
+		return nil, err
 	}
 
 	var packages []*Package

x-pack/auditbeat/module/system/package/package_homebrew_test.go

@@ -0,0 +1,97 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+// +build !windows
+
+package pkg
+
+import (
+	"os"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/elastic/beats/auditbeat/core"
+	abtest "github.com/elastic/beats/auditbeat/testing"
+	"github.com/elastic/beats/libbeat/beat"
+	mbtest "github.com/elastic/beats/metricbeat/mb/testing"
+)
+
+func TestHomebrew(t *testing.T) {
+	defer abtest.SetupDataDir(t)()
+
+	oldPath := homebrewCellarPath
+	defer func() {
+		homebrewCellarPath = oldPath
+	}()
+	homebrewCellarPath = "testdata/homebrew/"
+
+	// Test just listBrewPackages()
+	packages, err := listBrewPackages()
+	assert.NoError(t, err)
+	if assert.Len(t, packages, 1) {
+		pkg := packages[0]
+		assert.Equal(t, "test-package", pkg.Name)
+		assert.Equal(t, "Test package", pkg.Summary)
+		assert.Equal(t, "https://www.elastic.co/", pkg.URL)
+		assert.Equal(t, "1.0.0", pkg.Version)
+	}
+
+	// Test whole dataset if on Darwin
+	if runtime.GOOS == "darwin" {
+		f := mbtest.NewReportingMetricSetV2(t, getConfig())
+		defer f.(*MetricSet).bucket.DeleteBucket()
+
+		events, errs := mbtest.ReportingFetchV2(f)
+		if len(errs) > 0 {
+			t.Fatalf("received error: %+v", errs[0])
+		}
+
+		if assert.Len(t, events, 1) {
+			event := mbtest.StandardizeEvent(f, events[0], core.AddDatasetToEvent)
+			checkFieldValue(t, event, "system.audit.package.name", "test-package")
+			checkFieldValue(t, event, "system.audit.package.summary", "Test package")
+			checkFieldValue(t, event, "system.audit.package.url", "https://www.elastic.co/")
+			checkFieldValue(t, event, "system.audit.package.version", "1.0.0")
+			checkFieldValue(t, event, "system.audit.package.entity_id", "Krm421rtYM4wgq1S")
+		}
+	}
+}
+
+func checkFieldValue(t *testing.T, event beat.Event, fieldName string, fieldValue interface{}) {
+	value, err := event.GetValue(fieldName)
+	if assert.NoError(t, err) {
+		assert.Equal(t, fieldValue, value)
+	}
+}
+
+func TestHomebrewNotExist(t *testing.T) {
+	defer abtest.SetupDataDir(t)()
+
+	oldPath := homebrewCellarPath
+	defer func() {
+		homebrewCellarPath = oldPath
+	}()
+	homebrewCellarPath = "/does/not/exist"
+
+	// Test just listBrewPackages()
+	packages, err := listBrewPackages()
+	if assert.Error(t, err) {
+		assert.True(t, os.IsNotExist(err), "Unexpected error %v", err)
+	}
+	assert.Empty(t, packages)
+
+	// Test whole dataset if on Darwin
+	if runtime.GOOS == "darwin" {
+		f := mbtest.NewReportingMetricSetV2(t, getConfig())
+		defer f.(*MetricSet).bucket.DeleteBucket()
+
+		events, errs := mbtest.ReportingFetchV2(f)
+		if len(errs) > 0 {
+			t.Fatalf("received error: %+v", errs[0])
+		}
+		assert.Empty(t, events)
+	}
+}

x-pack/auditbeat/module/system/package/testdata/homebrew/test-package/1.0.0/.brew/test-package.rb

@@ -0,0 +1,4 @@
+class Test < Formula
+  desc "Test package"
+  homepage "https://www.elastic.co/"
+end

x-pack/auditbeat/module/system/package/testdata/homebrew/test-package/1.0.0/INSTALL_RECEIPT.json

@@ -0,0 +1 @@
+{"homebrew_version":"1.6.7-44-g1bfec50","used_options":[],"unused_options":["--without-cgo","--without-race"],"built_as_bottle":true,"poured_from_bottle":true,"installed_as_dependency":false,"installed_on_request":true,"changed_files":["INSTALL_RECEIPT.json","libexec/pkg/bootstrap/src/bootstrap/cmd/cgo/doc.go","libexec/src/cmd/cgo/doc.go","libexec/src/cmd/vendor/golang.org/x/arch/arm/armasm/objdumpext_test.go","libexec/src/crypto/x509/root_bsd.go","libexec/src/crypto/x509/root_unix.go","libexec/src/mime/type_dragonfly.go","libexec/src/mime/type_freebsd.go","libexec/src/net/http/cgi/host.go","libexec/src/path/filepath/example_unix_test.go"],"time":1533834877,"source_modified_time":1528329050,"HEAD":null,"stdlib":null,"compiler":"clang","aliases":["google-go","golang","go@1.10"],"runtime_dependencies":[],"source":{"path":"","tap":"homebrew/core","spec":"stable","versions":{"stable":"1.10.3","devel":"","head":"HEAD","version_scheme":0}}}