[Auditbeat] Fix docs and config for arm builds (elastic#23381)

* fix docs and config for arm builds * add changelog * include 386
kvch · Jan 11, 2021 · 5f4c725 · 5f4c725
1 parent 6e1426c
commit 5f4c725
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 3 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -249,6 +249,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - auditd: Fix an error condition causing a lot of `audit_send_reply` kernel threads being created. {pull}22673[22673]
 - system/socket: Fixed start failure when run under config reloader. {issue}20851[20851] {pull}21693[21693]
 - system/socket: Having some CPUs unavailable to Auditbeat could cause startup errors or event loss. {pull}22827[22827]
+- Note incompatibility of system/socket on ARM. {pull}23381[23381]
 
 *Filebeat*
 

diff --git a/x-pack/auditbeat/docs/modules/system.asciidoc b/x-pack/auditbeat/docs/modules/system.asciidoc
@@ -15,7 +15,7 @@ a system. All datasets send both periodic state information (e.g. all currently
 running processes) and real-time changes (e.g. when a new process starts
 or stops).
 
-The module is fully implemented for Linux. Some datasets are also available
+The module is fully implemented for Linux on x86. Currently, the `socket` module is not available on ARM. Some datasets are also available
 for macOS (Darwin) and Windows.
 
 [float]

diff --git a/x-pack/auditbeat/module/system/_meta/config.yml.tmpl b/x-pack/auditbeat/module/system/_meta/config.yml.tmpl
@@ -20,8 +20,10 @@
     - login   # User logins, logouts, and system boots.
     {{- end }}
     - process # Started and stopped processes
-    {{- if eq .GOOS "linux" }}
+    {{- if and (eq .GOOS "linux") (or (eq .GOARCH "amd64") (eq .GOARCH "386")) }}
     - socket  # Opened and closed sockets
+    {{- end }}
+    {{- if eq .GOOS "linux" }}
     - user    # User information
     {{- end }}
 

diff --git a/x-pack/auditbeat/module/system/_meta/docs.asciidoc b/x-pack/auditbeat/module/system/_meta/docs.asciidoc
@@ -8,7 +8,7 @@ a system. All datasets send both periodic state information (e.g. all currently
 running processes) and real-time changes (e.g. when a new process starts
 or stops).
 
-The module is fully implemented for Linux. Some datasets are also available
+The module is fully implemented for Linux on x86. Currently, the `socket` module is not available on ARM. Some datasets are also available
 for macOS (Darwin) and Windows.
 
 [float]