Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

aws-s3 input can delete SQS entries before they're fully acknowledged #38961

Closed
faec opened this issue Apr 16, 2024 · 2 comments
Closed

aws-s3 input can delete SQS entries before they're fully acknowledged #38961

faec opened this issue Apr 16, 2024 · 2 comments
Assignees
Labels
bug Team:Elastic-Agent Label for the Agent team

Comments

@faec
Copy link
Contributor

faec commented Apr 16, 2024

The SQS processing in the aws-s3 input tracks the acknowledgment status of S3 objects with the EventACKTracker helper. This helper has a bug where its Wait() function unblocks not just if its pending counter is zero, but if its pending counter has ever been zero after the first event. This means that if all active events are acknowledged at some intermediate stage while additional events are still being downloaded / processed, all later events will be considered to be immediately acknowledged, and the SQS entry will be deleted as soon as events have been added to the queue (even if they have not been ingested upstream).

@faec faec added bug Team:Elastic-Agent Label for the Agent team labels Apr 16, 2024
@faec faec self-assigned this Apr 16, 2024
@elasticmachine
Copy link
Collaborator

Pinging @elastic/elastic-agent (Team:Elastic-Agent)

@faec faec changed the title awss3 input can delete SQS entries before they're fully acknowledged aws-s3 input can delete SQS entries before they're fully acknowledged Apr 22, 2024
faec added a commit that referenced this issue Apr 23, 2024
Remove `EventACKTracker` from `awscloudwatch` event handling.

`EventACKTracker` is buggy (see #38961) but in the `awscloudwatch` input it's also never used -- its callbacks are attached to events, but their result doesn't affect any of the event handling.

This PR doesn't change any functional behavior.
@faec
Copy link
Contributor Author

faec commented Oct 21, 2024

Fixed by #40699, which removed the last caller of EventACKTracker.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Team:Elastic-Agent Label for the Agent team
Projects
None yet
Development

No branches or pull requests

2 participants