Craig MacKenzie

> They're running when I check top and event Elastic Agent and its child processes show as sleeping. One of the agent processes was the one I did see running...

Direct use of `journalctl` is the approach currently used by the OTel collector, related discussion in https://github.com/open-telemetry/opentelemetry-collector-contrib/issues/2332

From the comment in https://github.com/elastic/beats/issues/37086#issuecomment-1885856333 implying the documents the journald input produces are unlikely to be optimal today, we need to add a task to compare the structure and metadata...

The journald input is in technical preview, you can make whatever changes are needed breaking or not. That said, people are using it as is so don't make breaking changes...

@faec I see https://github.com/elastic/beats/issues/39414 is still open, which seems like the largest remaining performance bottleneck. Just to confirm, does that still need to be resolved? Or is it covered by...

> We could add something about compatible versions of systemd in our documentation, but aside from it I can't see anything else we could do at the moment. Yes we...

> the moment the best option seems to make the journald input resilient to journalctl crashes Even if this bug didn't exist we should be doing this and automatically recovering...

Same as https://github.com/elastic/beats/issues/32782 essentially. We need to automatically recover from this if we aren't already.

This one seems more like system memory exhaustion though, how much memory is available on the host when it happens? Can other programs allocate memory?

I think there might be Beats tests for this that also fails occasionally: https://beats-ci.elastic.co/job/Beats/job/beats/job/main/1640/testReport/junit/metricbeat.tests.system.test_base/Test/ExtendedWin___metricbeat_windows_11_windows_11___test_start_stop/ ``` self = @unittest.skipUnless(re.match("(?i)win|linux|darwin|freebsd|openbsd", sys.platform), "os") def test_start_stop(self): """ Metricbeat starts and stops without error. """...