Beats: Auditbeat doesn't start due to corrupt meta.json

[adriansr]

@xeraa reports a fresh install of Auditbeat 6.4.2 on a fresh VM fails to start due to a corrupted meta.json.

2018-10-03T08:06:22.814Z        INFO    instance/beat.go:544    Home path: [/usr/share/auditbeat] Config path: [/etc/auditbeat] Data path: [/var/lib/auditbeat] Logs path: [/var/log/auditbeat]
2018-10-03T08:06:22.815Z        INFO    instance/beat.go:315    auditbeat stopped.
2018-10-03T08:06:22.824Z        ERROR   instance/beat.go:743    Exiting: Beat meta file reading error: EOF

meta.json is empty:

-rw------- 1 root root     0 Oct  2 23:46 meta.json

Auditbeat started fine after the file is removed.

• [ ] investigate what could've caused the empty file in the first place.
• [ ] (discuss) consider not failing startup when loading meta.json files.

For confirmed bugs, please report:

• Version: 6.4.2
• Operating System: Ubuntu 16.04
• Discuss Forum URL: n/a
• Steps to Reproduce:

[xeraa]

Auditbeat 6.4.2 on Ubuntu 18.04. Installed by downloading the DEB (checksum matched) and then dpkg -i.

[exekias]

Do we have the contents of the broken meta file?

Note about starting without it: some subsystems (like monitoring or management) use the UUID to identify themselves, starting without it or regenerating it, could cause issues there.

[xeraa]

The file was just empty:

-rw------- 1 root root     0 Oct  2 23:46 meta.json

[exekias]

Some day I'll learn to read :innocent:, thanks

[michalpristas]

@xeraa is it something you can reproduce. have you performed any configuration changes, configuring output...
also, do you run it using systemd or by hand?
trying to reproduce on Ubuntu 18 and 16 with a fresh install of auditbeat 6.4 but was not able to repro

[xeraa]

I had the same issue last week with 6.6.0 (or 6.6.1, not sure any more). It's fully automated: https://github.com/xeraa/auditbeat-in-action/blob/master/configure.yml. If I skip the stopping of Auditd, Auditbeat doesn't start up correctly any more.

Auditbeat config in https://github.com/xeraa/auditbeat-in-action/blob/master/templates/auditbeat.yml