metricbeat/system: check requirements for metricsets in the constructor

[mauri870]

Some system metricsets require kernel modules to be loaded or other prerequisites to be met in order to function properly. We should make a best effort to always check these requirements in the metricset's New method.

An example of such a scenario can be found in https://github.com/elastic/elastic-agent/issues/6155. In this case, the absence of the nf_conntrack module caused errors during metric collection. Similarly, RAID metrics fail during fetching if the system was not configured for RAID. These issues could have been avoided by checking these conditions during the metricset creation process.

Additionally, this approach helps inform the user of necessary actions by displaying an error when data collection from a specific source is requested but cannot proceed without modifications to the host system. Communicating these requirements to the user is a key purpose of this feature.

For the raid and conntrack metricsets, in the New method:

• raid: Check that the system has a RAID configuration
• conntrack: check that the nf_conntrack module is loaded (probably just checking if /proc/net/stat/nf_conntrack exists is enough)

We should also check the remaining system metricsets if they fall into this category. I'd say at least the metricsets that require a kernel module (under system/linux) to be loaded should check for it in the constructor.

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[BenB196]

I had opened some issues a while back under the integrations project, I only found one additional issue, https://github.com/elastic/integrations/issues/4880, but it's been a bit since I checked, not sure if new ones were introduced.

https://github.com/elastic/integrations/issues/4879 https://github.com/elastic/integrations/issues/4881

[mauri870]

I had opened some issues a while back under the integrations project, I only found one additional issue, elastic/integrations#4880, but it's been a bit since I checked, not sure if new ones were introduced.

Thanks for linking to these issues. It’s likely the same problem I’m describing here. It seems the issue is even broader than I initially thought. Looks like most modules in system/linux require kernel modules to operate.

[VihasMakwana]

+1 for this.

[botelastic[bot]]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!