{"action":"created","comment":{"url":"https://api.github.com/repos/elastic/beats/pulls/comments/126791318","pull_request_review_id":49308430,"id":126791318,"diff_hunk":"@@ -1,43 +1,62 @@\n package file\n \n import (\n-\t\"fmt\"\n \t\"os\"\n+\t\"os/user\"\n+\t\"strconv\"\n \t\"syscall\"\n \t\"time\"\n \n+\t\"github.com/joeshaw/multierror\"\n \t\"github.com/pkg/errors\"\n )\n \n-func addFileAttributes(e *Event, maxFileSize int64) error {\n-\tinfo, err := os.Lstat(e.Path)\n+func Stat(path string) (*Metadata, error) {\n+\tinfo, err := os.Lstat(path)\n \tif err != nil {\n-\t\treturn errors.Wrap(err, \"failed to stat file\")\n+\t\treturn nil, errors.Wrap(err, \"failed to stat path\")","path":"auditbeat/module/audit/file/fileinfo_linux.go","position":21,"original_position":21,"commit_id":"bb7e1dce4ab598bf399b63a502fe0e1f91eec655","original_commit_id":"bb7e1dce4ab598bf399b63a502fe0e1f91eec655","user":{"login":"ruflin","id":244900,"avatar_url":"https://avatars0.githubusercontent.com/u/244900?v=3","gravatar_id":"","url":"https://api.github.com/users/ruflin","html_url":"https://github.com/ruflin","followers_url":"https://api.github.com/users/ruflin/followers","following_url":"https://api.github.com/users/ruflin/following{/other_user}","gists_url":"https://api.github.com/users/ruflin/gists{/gist_id}","starred_url":"https://api.github.com/users/ruflin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ruflin/subscriptions","organizations_url":"https://api.github.com/users/ruflin/orgs","repos_url":"https://api.github.com/users/ruflin/repos","events_url":"https://api.github.com/users/ruflin/events{/privacy}","received_events_url":"https://api.github.com/users/ruflin/received_events","type":"User","site_admin":false},"body":"See comments above for logging, also line 22.","created_at":"2017-07-11T19:55:01Z","updated_at":"2017-07-11T20:00:54Z","html_url":"https://github.com/elastic/beats/pull/4636#discussion_r126791318","pull_request_url":"https://api.github.com/repos/elastic/beats/pulls/4636","_links":{"self":{"href":"https://api.github.com/repos/elastic/beats/pulls/comments/126791318"},"html":{"href":"https://github.com/elastic/beats/pull/4636#discussion_r126791318"},"pull_request":{"href":"https://api.github.com/repos/elastic/beats/pulls/4636"}}},"pull_request":{"url":"https://api.github.com/repos/elastic/beats/pulls/4636","id":129600897,"html_url":"https://github.com/elastic/beats/pull/4636","diff_url":"https://github.com/elastic/beats/pull/4636.diff","patch_url":"https://github.com/elastic/beats/pull/4636.patch","issue_url":"https://api.github.com/repos/elastic/beats/issues/4636","number":4636,"state":"open","locked":false,"title":"Auditbeat file module improvements","user":{"login":"andrewkroh","id":4565752,"avatar_url":"https://avatars1.githubusercontent.com/u/4565752?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewkroh","html_url":"https://github.com/andrewkroh","followers_url":"https://api.github.com/users/andrewkroh/followers","following_url":"https://api.github.com/users/andrewkroh/following{/other_user}","gists_url":"https://api.github.com/users/andrewkroh/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewkroh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewkroh/subscriptions","organizations_url":"https://api.github.com/users/andrewkroh/orgs","repos_url":"https://api.github.com/users/andrewkroh/repos","events_url":"https://api.github.com/users/andrewkroh/events{/privacy}","received_events_url":"https://api.github.com/users/andrewkroh/received_events","type":"User","site_admin":false},"body":"Unify the behavior across operating systems.\r\n\r\n- Add tests.\r\n- Resolve UID/GID/SID into owner/group.\r\n- Log warning if a file watch cannot be added. Previously it would fail at startup.\r\n- Remove usage of fsevents on macOS and use kqueues instead. The data provided was inconsistent with the fsnotify. It was valuable data but the signal needs some refinement to make it consistent. The biggest issue is that multiple events are coalesced into one. Another issue is that the watches are recursive (this is great, but it's inconsistent) and we will need to allow a glob to be specified then match the incoming events against the glob (future enhancement).\r\n- Document hash fields\r\n- Initialize watches on Start() rather than at construction time.\r\n- Update data.json to include file owner and group names.\r\n- Add file type and symlink target path to the events.\r\n- Filter fsnotify events with empty paths (saw this once on Windows).\r\n\r\nAnd add a simple dashboard:\r\n\r\n![image](https://raw.githubusercontent.com/andrewkroh/beats/bb7e1dce4ab598bf399b63a502fe0e1f91eec655/auditbeat/docs/images/auditbeat-file-integrity-dashboard.png)","created_at":"2017-07-10T04:54:27Z","updated_at":"2017-07-11T20:00:54Z","closed_at":null,"merged_at":null,"merge_commit_sha":"113aa4a5967d91f8ca85595fcdeb3afadea057d5","assignee":null,"assignees":[],"requested_reviewers":[],"milestone":null,"commits_url":"https://api.github.com/repos/elastic/beats/pulls/4636/commits","review_comments_url":"https://api.github.com/repos/elastic/beats/pulls/4636/comments","review_comment_url":"https://api.github.com/repos/elastic/beats/pulls/comments{/number}","comments_url":"https://api.github.com/repos/elastic/beats/issues/4636/comments","statuses_url":"https://api.github.com/repos/elastic/beats/statuses/bb7e1dce4ab598bf399b63a502fe0e1f91eec655","head":{"label":"andrewkroh:feature/ab/audit-file-tests","ref":"feature/ab/audit-file-tests","sha":"bb7e1dce4ab598bf399b63a502fe0e1f91eec655","user":{"login":"andrewkroh","id":4565752,"avatar_url":"https://avatars1.githubusercontent.com/u/4565752?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewkroh","html_url":"https://github.com/andrewkroh","followers_url":"https://api.github.com/users/andrewkroh/followers","following_url":"https://api.github.com/users/andrewkroh/following{/other_user}","gists_url":"https://api.github.com/users/andrewkroh/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewkroh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewkroh/subscriptions","organizations_url":"https://api.github.com/users/andrewkroh/orgs","repos_url":"https://api.github.com/users/andrewkroh/repos","events_url":"https://api.github.com/users/andrewkroh/events{/privacy}","received_events_url":"https://api.github.com/users/andrewkroh/received_events","type":"User","site_admin":false},"repo":{"id":38412372,"name":"beats","full_name":"andrewkroh/beats","owner":{"login":"andrewkroh","id":4565752,"avatar_url":"https://avatars1.githubusercontent.com/u/4565752?v=3","gravatar_id":"","url":"https://api.github.com/users/andrewkroh","html_url":"https://github.com/andrewkroh","followers_url":"https://api.github.com/users/andrewkroh/followers","following_url":"https://api.github.com/users/andrewkroh/following{/other_user}","gists_url":"https://api.github.com/users/andrewkroh/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewkroh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewkroh/subscriptions","organizations_url":"https://api.github.com/users/andrewkroh/orgs","repos_url":"https://api.github.com/users/andrewkroh/repos","events_url":"https://api.github.com/users/andrewkroh/events{/privacy}","received_events_url":"https://api.github.com/users/andrewkroh/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/andrewkroh/beats","description":"Beats - Lightweight shippers for Elasticsearch & Logstash ","fork":true,"url":"https://api.github.com/repos/andrewkroh/beats","forks_url":"https://api.github.com/repos/andrewkroh/beats/forks","keys_url":"https://api.github.com/repos/andrewkroh/beats/keys{/key_id}","collaborators_url":"https://api.github.com/repos/andrewkroh/beats/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/andrewkroh/beats/teams","hooks_url":"https://api.github.com/repos/andrewkroh/beats/hooks","issue_events_url":"https://api.github.com/repos/andrewkroh/beats/issues/events{/number}","events_url":"https://api.github.com/repos/andrewkroh/beats/events","assignees_url":"https://api.github.com/repos/andrewkroh/beats/assignees{/user}","branches_url":"https://api.github.com/repos/andrewkroh/beats/branches{/branch}","tags_url":"https://api.github.com/repos/andrewkroh/beats/tags","blobs_url":"https://api.github.com/repos/andrewkroh/beats/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/andrewkroh/beats/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/andrewkroh/beats/git/refs{/sha}","trees_url":"https://api.github.com/repos/andrewkroh/beats/git/trees{/sha}","statuses_url":"https://api.github.com/repos/andrewkroh/beats/statuses/{sha}","languages_url":"https://api.github.com/repos/andrewkroh/beats/languages","stargazers_url":"https://api.github.com/repos/andrewkroh/beats/stargazers","contributors_url":"https://api.github.com/repos/andrewkroh/beats/contributors","subscribers_url":"https://api.github.com/repos/andrewkroh/beats/subscribers","subscription_url":"https://api.github.com/repos/andrewkroh/beats/subscription","commits_url":"https://api.github.com/repos/andrewkroh/beats/commits{/sha}","git_commits_url":"https://api.github.com/repos/andrewkroh/beats/git/commits{/sha}","comments_url":"https://api.github.com/repos/andrewkroh/beats/comments{/number}","issue_comment_url":"https://api.github.com/repos/andrewkroh/beats/issues/comments{/number}","contents_url":"https://api.github.com/repos/andrewkroh/beats/contents/{+path}","compare_url":"https://api.github.com/repos/andrewkroh/beats/compare/{base}...{head}","merges_url":"https://api.github.com/repos/andrewkroh/beats/merges","archive_url":"https://api.github.com/repos/andrewkroh/beats/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/andrewkroh/beats/downloads","issues_url":"https://api.github.com/repos/andrewkroh/beats/issues{/number}","pulls_url":"https://api.github.com/repos/andrewkroh/beats/pulls{/number}","milestones_url":"https://api.github.com/repos/andrewkroh/beats/milestones{/number}","notifications_url":"https://api.github.com/repos/andrewkroh/beats/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/andrewkroh/beats/labels{/name}","releases_url":"https://api.github.com/repos/andrewkroh/beats/releases{/id}","deployments_url":"https://api.github.com/repos/andrewkroh/beats/deployments","created_at":"2015-07-02T05:03:11Z","updated_at":"2016-11-02T22:37:17Z","pushed_at":"2017-07-11T02:09:38Z","git_url":"git://github.com/andrewkroh/beats.git","ssh_url":"git@github.com:andrewkroh/beats.git","clone_url":"https://github.com/andrewkroh/beats.git","svn_url":"https://github.com/andrewkroh/beats","homepage":"https://www.elastic.co/products/beats","size":57464,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"elastic:master","ref":"master","sha":"d26a2d76074a1c3abbb6b1b3742c1f05ce28be2d","user":{"login":"elastic","id":6764390,"avatar_url":"https://avatars3.githubusercontent.com/u/6764390?v=3","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"repo":{"id":16554739,"name":"beats","full_name":"elastic/beats","owner":{"login":"elastic","id":6764390,"avatar_url":"https://avatars3.githubusercontent.com/u/6764390?v=3","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/elastic/beats","description":":tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash ","fork":false,"url":"https://api.github.com/repos/elastic/beats","forks_url":"https://api.github.com/repos/elastic/beats/forks","keys_url":"https://api.github.com/repos/elastic/beats/keys{/key_id}","collaborators_url":"https://api.github.com/repos/elastic/beats/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/elastic/beats/teams","hooks_url":"https://api.github.com/repos/elastic/beats/hooks","issue_events_url":"https://api.github.com/repos/elastic/beats/issues/events{/number}","events_url":"https://api.github.com/repos/elastic/beats/events","assignees_url":"https://api.github.com/repos/elastic/beats/assignees{/user}","branches_url":"https://api.github.com/repos/elastic/beats/branches{/branch}","tags_url":"https://api.github.com/repos/elastic/beats/tags","blobs_url":"https://api.github.com/repos/elastic/beats/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/elastic/beats/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/elastic/beats/git/refs{/sha}","trees_url":"https://api.github.com/repos/elastic/beats/git/trees{/sha}","statuses_url":"https://api.github.com/repos/elastic/beats/statuses/{sha}","languages_url":"https://api.github.com/repos/elastic/beats/languages","stargazers_url":"https://api.github.com/repos/elastic/beats/stargazers","contributors_url":"https://api.github.com/repos/elastic/beats/contributors","subscribers_url":"https://api.github.com/repos/elastic/beats/subscribers","subscription_url":"https://api.github.com/repos/elastic/beats/subscription","commits_url":"https://api.github.com/repos/elastic/beats/commits{/sha}","git_commits_url":"https://api.github.com/repos/elastic/beats/git/commits{/sha}","comments_url":"https://api.github.com/repos/elastic/beats/comments{/number}","issue_comment_url":"https://api.github.com/repos/elastic/beats/issues/comments{/number}","contents_url":"https://api.github.com/repos/elastic/beats/contents/{+path}","compare_url":"https://api.github.com/repos/elastic/beats/compare/{base}...{head}","merges_url":"https://api.github.com/repos/elastic/beats/merges","archive_url":"https://api.github.com/repos/elastic/beats/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/elastic/beats/downloads","issues_url":"https://api.github.com/repos/elastic/beats/issues{/number}","pulls_url":"https://api.github.com/repos/elastic/beats/pulls{/number}","milestones_url":"https://api.github.com/repos/elastic/beats/milestones{/number}","notifications_url":"https://api.github.com/repos/elastic/beats/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/elastic/beats/labels{/name}","releases_url":"https://api.github.com/repos/elastic/beats/releases{/id}","deployments_url":"https://api.github.com/repos/elastic/beats/deployments","created_at":"2014-02-05T19:01:02Z","updated_at":"2017-07-11T08:26:44Z","pushed_at":"2017-07-11T19:30:40Z","git_url":"git://github.com/elastic/beats.git","ssh_url":"git@github.com:elastic/beats.git","clone_url":"https://github.com/elastic/beats.git","svn_url":"https://github.com/elastic/beats","homepage":"https://www.elastic.co/products/beats","size":57477,"stargazers_count":4187,"watchers_count":4187,"language":"Go","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1057,"mirror_url":null,"open_issues_count":475,"forks":1057,"open_issues":475,"watchers":4187,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/elastic/beats/pulls/4636"},"html":{"href":"https://github.com/elastic/beats/pull/4636"},"issue":{"href":"https://api.github.com/repos/elastic/beats/issues/4636"},"comments":{"href":"https://api.github.com/repos/elastic/beats/issues/4636/comments"},"review_comments":{"href":"https://api.github.com/repos/elastic/beats/pulls/4636/comments"},"review_comment":{"href":"https://api.github.com/repos/elastic/beats/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/elastic/beats/pulls/4636/commits"},"statuses":{"href":"https://api.github.com/repos/elastic/beats/statuses/bb7e1dce4ab598bf399b63a502fe0e1f91eec655"}}}}
{"actor":{"display_login":"ruflin"}}