[Packetbeat] Error is shown on installing packetbeat

Describe the bug:

Error is shown on installing packetbeat

Build Details:

Version: 8.1.0 BC3
Build: 50346
Commit: 0335dd6a26ef29ae9021d0fae9347dc88f3b7d6e

Precondition:

Deploy 8.1.0 BC3 Elastic Cloud Build on Production Platform

Steps to Reproduce

1. RDP to the windows 64 bit vm.
2. Download and extract the packetbeat-8.1.0-windows-x86_64.zip.
3. Run power shell in admin mode.
4. Run .\install-service-packetbeat.ps1
5. Run .\packetbeat setup
6. Run Start-Service packetbeat
7. Observed that error is shown.

Actual Result:
Error is shown on Starting Services of packetbeat on window 64 bit

Expected Result:
Packet beat services should be started on the windows 64 bit

Screenshot:

What's not working:

This issue also exists for Deploying 8.1.0 BC3 Elastic Cloud Build on Staging Platform

[elasticmachine]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[dikshachauhan-qasource]

Reviewed and assigned to @kvch

[jlind23]

@adriansr it rather seems to be falling in your area. Am I correct?

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[adriansr]

You're right, @jlind23 , having a look.

[adriansr]

@prachigupta-qasource

I'm reproducing the error. It seems that aprox 50% of the time the Packetbeat service starts and then terminates after a few seconds (crashes?). Is this what you observe, that it can start sometimes? When it fails the logs end in:

{"log.level":"info","@timestamp":"2022-02-21T15:29:49.442Z","log.logger":"esclientleg","log.origin":{"file.name":"eslegclient/connection.go","file.line":105},"message":"elasticsearch url: http://localhost:9200","service.name":"packetbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-02-21T15:29:49.443Z","log.logger":"publisher","log.origin":{"file.name":"pipeline/module.go","file.line":113},"message":"Beat name: asr-testing-windows-removeme","service.name":"packetbeat","ecs.version":"1.6.0"}

Can you confirm?

[adriansr]

Update after more testing:

• It also fails when run manually from the terminal (easier to debug).
• The process is terminated, not crashed.
• Happens after it executes npcap.exe for installation.
• It's failing exactly every odd execution, for some reason.

It think this could be due to #30396 and #30438 not being backported to the 8.1 branch. I can't say for sure because I didn't manage to test with a main build (can't get npcap.exe to work), but at least it doesn't fail without the embedded npcap installation.

@efd6 can you have a look?

I think either those backports are needed or we have to use npcap's /no_kill flag.

[efd6]

Yes, if there is no Npcap/WinPcap installed on the system, I would not expect the startup to work without those fixes backported (the bundled npcap installer will never be run). I would expect packetbeat to attempt to collect interfaces to listen on, fail that and so terminate. Is that what you saw, @adriansr?

I'm curious about the even-odd behaviour; that is not something that I would expect. I don't think /no_kill would have any effect here since we never try to uninstall the library. (This is not true, under Windows, an upgrade is an uninstall/reinstall pair).