Filebeat fails to start on 32-bit Linux with `fatal error: runtime: netpoll failed`

[andrzej-stencel]

Basic information

Version: 7.17.15 and later, including latest 7.17.21 (7.17.14 works fine)

Operating System: 32-bit Linux (Ubuntu 16.04)

Discuss Forum URL: https://discuss.elastic.co/t/filebeat-v7-17-15-linux-binary-fails-to-start-filebeat-on-x86/347561

Steps to Reproduce

1. Download Filebeat 7.17.15 for 32-bit Linux from https://www.elastic.co/downloads/past-releases/filebeat-7-17-15
2. Unpack the archive
3. Go to the unpacked directory and run the beat

curl -LO https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.17.15-linux-x86.tar.gz
tar zxvf filebeat-7.17.15-linux-x86.tar.gz
cd filebeat-7.17.15-linux-x86
./filebeat -e > stdout.log 2> stderr.log

Actual result

The beat fails to start with empty stdout.log and the following stderr.log:

2024-05-20T11:19:54.731+0200	INFO	instance/beat.go:698	Home path: [/home/jedr/Downloads/filebeat-7.17.15-linux-x86] Config path: [/home/jedr/Downloads/filebeat-7.17.15-linux-x86] Data path: [/home/jedr/Downloads/filebeat-7.17.15-linux-x86/data] Logs path: [/home/jedr/Downloads/filebeat-7.17.15-linux-x86/logs] Hostfs Path: [/]
2024-05-20T11:19:54.732+0200	INFO	instance/beat.go:706	Beat ID: 0089b82f-70e8-48cd-9460-4a97fd93415d
2024-05-20T11:19:57.738+0200	WARN	[add_cloud_metadata]	add_cloud_metadata/provider_aws_ec2.go:79	read token request for getting IMDSv2 token returns empty: Put "http://169.254.169.254/latest/api/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers). No token in the metadata request will be used.
2024-05-20T11:19:57.745+0200	INFO	[seccomp]	seccomp/seccomp.go:124	Syscall filter successfully installed
2024-05-20T11:19:57.745+0200	INFO	[beat]	instance/beat.go:1052	Beat info	{"system_info": {"beat": {"path": {"config": "/home/jedr/Downloads/filebeat-7.17.15-linux-x86", "data": "/home/jedr/Downloads/filebeat-7.17.15-linux-x86/data", "home": "/home/jedr/Downloads/filebeat-7.17.15-linux-x86", "logs": "/home/jedr/Downloads/filebeat-7.17.15-linux-x86/logs"}, "type": "filebeat", "uuid": "0089b82f-70e8-48cd-9460-4a97fd93415d"}}}
2024-05-20T11:19:57.746+0200	INFO	[beat]	instance/beat.go:1061	Build info	{"system_info": {"build": {"commit": "b474d2803ed2961f23f614d7213d9099fb0b4354", "libbeat": "7.17.15", "time": "2023-11-08T19:08:35.000Z", "version": "7.17.15"}}}
2024-05-20T11:19:57.746+0200	INFO	[beat]	instance/beat.go:1064	Go runtime info	{"system_info": {"go": {"os":"linux","arch":"386","max_procs":2,"version":"go1.20.10"}}}
runtime: epollwait on fd 3 failed with 1
fatal error: runtime: netpoll failed

runtime stack:
# removed as too long for issue body, see attached file stderr.log.

Expected result

The beat runs successfully.

Additional information

This issue apparently started on v7.17.15, as running v7.17.14 is successful.

I believe the same issue affects metricbeat, haven't checked other beats.

[elasticmachine]

Pinging @elastic/elastic-agent (Team:Elastic-Agent)

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[andrzej-stencel]

Seems to work fine on Windows 32-bit.

[botelastic[bot]]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!