[auditbeat][fim] Update Auditbeat file_integrity module to default to auto backend with intelligent fallback by marc-gr · Pull Request #47498 · elastic/beats

marc-gr · 2025-11-06T09:22:36Z

Proposed commit message

The auto backend option now tries the backends in order until the best available option is found

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

Author's Checklist

[ ]

How to test this PR locally

Related issues

Closes [auditbeat][fim] Improve handling of backend choice #46690

Use cases

Screenshots

Logs

…o backend with intelligent fallback

elasticmachine · 2025-11-06T09:22:41Z

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

github-actions · 2025-11-06T09:22:46Z

🤖 GitHub comments

Just comment with:

run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

github-actions · 2025-11-06T09:24:10Z

🔍 Preview links for changed docs

…file integrity module

… test configuration for backend fallback

…ng to maintain test behavior

…n for file integrity tests

nicholasberlin

LGTM

colleenmcginnis

I left some suggestions below on how to structure cumulative documentation.

coderabbitai · 2026-03-30T08:49:21Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8c44f2bc-ecd0-4e2c-a923-70e17b8584aa

📥 Commits

Reviewing files that changed from the base of the PR and between 0bd2296 and 6cd36d1.

📒 Files selected for processing (2)

auditbeat/module/file_integrity/_meta/docs.md
docs/reference/auditbeat/auditbeat-module-file_integrity.md

📝 Walkthrough

Walkthrough

The file_integrity module's backend default changed from fsnotify to auto. A centralized event-reader initialization layer was added that selects backends by platform-specific priority (Linux: ebpf → kprobes → fsnotify; Windows: etw → fsnotify; others: fsnotify) and tries initializers in order. Backend initializers now perform upfront availability checks and return errors early. Validation now checks against supportedBackends. Platform-specific eventreader_*.go files provide autoBackendOrder and supportedBackends mappings. Tests, docs, and reference YAMLs were updated accordingly.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	PR implements all core objectives from `#46690`: auto backend with platform-specific preferences (Linux: eBPF→kprobes→fsnotify; Windows: ETW→fsnotify) and explicit backend selection without fallback.
Out of Scope Changes check	✅ Passed	All changes align with auto backend implementation: config updates, backend initialization refactoring, documentation, tests, and changelog are in scope.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

🛠️ Update Documentation: Commit on current branch
🛠️ Update Documentation: Create PR

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

marc-gr · 2026-04-01T11:30:55Z

cc @elastic/ingest-docs please if anyone can take a look

alexandra5000

LGTM with some minor changes 🙂

vishaangelova

Some suggestions to update the applies_to badges with the syntax for version ranges.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@auditbeat/module/file_integrity/_meta/docs.md`:
- Around line 103-104: The Linux backend applicability is inconsistent: the
block showing "{applies_to}`stack: preview 9.4.0+` `auto`" conflicts with the
other occurrence that marks Linux `auto` as GA; update this snippet so the Linux
backend uses the same GA applicability range as the other reference (replace the
preview applicability for `auto` with the GA range used elsewhere), ensuring the
two lines that mention `{applies_to}`stack: preview 9.4.0+` `auto`` and
`{applies_to}`stack: ga 9.0.0-9.3` `fsnotify`` are aligned and consistent.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a26faf8a-e57a-415f-9945-a0cdb2b82156

📥 Commits

Reviewing files that changed from the base of the PR and between c98434e and 0bd2296.

📒 Files selected for processing (2)

auditbeat/module/file_integrity/_meta/docs.md
docs/reference/auditbeat/auditbeat-module-file_integrity.md

vishaangelova

LGTM

enhancement: Update Auditbeat file_integrity module to default to aut…

066c2a1

…o backend with intelligent fallback

marc-gr requested review from a team as code owners November 6, 2025 09:22

marc-gr added enhancement docs Auditbeat backport-skip Skip notification from the automated backport with mergify Team:Security-Linux Platform Linux Platform Team in Security Solution labels Nov 6, 2025

botelastic Bot added the needs_team Indicates that the issue/PR needs a Team:* label label Nov 6, 2025

botelastic Bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Nov 6, 2025

mergify Bot assigned marc-gr Nov 6, 2025

marc-gr marked this pull request as draft November 6, 2025 09:45

enhancement: Implement backend validation and fallback mechanism for …

541e83a

…file integrity module

marc-gr marked this pull request as ready for review November 6, 2025 11:10

nicholasberlin reviewed Nov 6, 2025

View reviewed changes

Comment thread auditbeat/module/file_integrity/ebpfreader_supported.go

marc-gr added 3 commits November 6, 2025 13:59

enhancement: Improve ETW backend flush interval validation and update…

fcec841

… test configuration for backend fallback

enhancement: Explicitly set backend to 'fsnotify' in TestErrorReporti…

2c3f42d

…ng to maintain test behavior

enhancement: Add support for Windows platform in backend configuratio…

93e5293

…n for file integrity tests

marc-gr requested a review from nicholasberlin November 7, 2025 13:30

Merge branch 'main' into feat/fim-auto-backend

8fc222a

nicholasberlin approved these changes Nov 7, 2025

View reviewed changes

colleenmcginnis reviewed Nov 18, 2025

View reviewed changes

Comment thread auditbeat/module/file_integrity/_meta/docs.md Outdated

Comment thread auditbeat/module/file_integrity/_meta/docs.md Outdated

Comment thread auditbeat/module/file_integrity/_meta/docs.md Outdated

Comment thread auditbeat/module/file_integrity/_meta/docs.md Outdated

marc-gr added 2 commits March 30, 2026 10:16

Merge remote-tracking branch 'upstream/main' into feat/fim-auto-backend

1cbf3b1

apply doc changes

c98434e

marc-gr requested a review from colleenmcginnis March 30, 2026 08:52

Merge branch 'main' into feat/fim-auto-backend

4d7bab9

marc-gr removed the request for review from colleenmcginnis March 31, 2026 11:28

marc-gr added docs and removed docs labels Mar 31, 2026

Merge branch 'main' into feat/fim-auto-backend

53050bd

alexandra5000 reviewed Apr 8, 2026

View reviewed changes

vishaangelova reviewed Apr 8, 2026

View reviewed changes

Address suggestions

0bd2296

coderabbitai Bot reviewed Apr 8, 2026

View reviewed changes

Comment thread auditbeat/module/file_integrity/_meta/docs.md Outdated

Fix ga preview

6cd36d1

vishaangelova approved these changes Apr 8, 2026

View reviewed changes

marc-gr enabled auto-merge (squash) April 8, 2026 10:51

marc-gr merged commit f2a90c5 into elastic:main Apr 8, 2026
41 of 44 checks passed

marc-gr deleted the feat/fim-auto-backend branch April 8, 2026 11:50

marc-gr mentioned this pull request Apr 16, 2026

[auditbeat][fim] Revert "Update Auditbeat file_integrity module to default to auto backend with intelligent fallback" #50166

Merged

mergify Bot mentioned this pull request Apr 21, 2026

[9.4](backport #50166) [auditbeat][fim] Revert "Update Auditbeat file_integrity module to default to auto backend with intelligent fallback" #50224

Merged

github-actions Bot mentioned this pull request Apr 21, 2026

[ux-design-patrol] Auditbeat file_integrity backend validation conflicts with documented Windows fsnotify support #50233

Open

4 tasks

Conversation

marc-gr commented Nov 6, 2025

Proposed commit message

Checklist

Disruptive User Impact

Author's Checklist

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

Uh oh!

elasticmachine commented Nov 6, 2025

Uh oh!

github-actions Bot commented Nov 6, 2025

🤖 GitHub comments

Uh oh!

github-actions Bot commented Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

Uh oh!

nicholasberlin left a comment

Choose a reason for hiding this comment

Uh oh!

colleenmcginnis left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

marc-gr commented Apr 1, 2026

Uh oh!

alexandra5000 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vishaangelova left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vishaangelova left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

github-actions Bot commented Nov 6, 2025 •

edited

Loading

coderabbitai Bot commented Mar 30, 2026 •

edited

Loading