Lower logging levels in add_session_metadata processor

x-pack/auditbeat/processors/sessionmd/add_session_metadata.go

@@ -166,15 +166,15 @@ func (p *addSessionMetadata) enrich(ev *beat.Event) (*beat.Event, error) {
 		proc, err := p.provider.GetProcess(pid)
 		if err != nil {
 			e := fmt.Errorf("pid %v not found in db: %w", pid, err)
-			p.logger.Warnw("PID not found in provider", "pid", pid, "error", err)
+			p.logger.Debugw("PID not found in provider", "pid", pid, "error", err)
 			return nil, e
 		}
 		fullProcess = *proc
 	} else {
 		fullProcess, err = p.db.GetProcess(pid)
 		if err != nil {
 			e := fmt.Errorf("pid %v not found in db: %w", pid, err)
-			p.logger.Warnw("PID not found in provider", "pid", pid, "error", err)
+			p.logger.Debugw("PID not found in provider", "pid", pid, "error", err)
 			return nil, e
 		}
 	}

x-pack/auditbeat/processors/sessionmd/processdb/db.go

@@ -421,7 +421,7 @@ func (db *DB) InsertExit(exit types.ProcessExitEvent) {
 	pid := exit.PIDs.Tgid
 	process, ok := db.processes[pid]
 	if !ok {
-		db.logger.Errorf("could not insert exit, pid %v not found in db", pid)
+		db.logger.Debugf("could not insert exit, pid %v not found in db", pid)
 		return
 	}
 	process.ExitCode = exit.ExitCode

x-pack/auditbeat/processors/sessionmd/procfs/procfs.go

@@ -196,7 +196,7 @@ func (r ProcfsReader) GetAllProcesses() ([]ProcessInfo, error) {
 	for _, proc := range procs {
 		process_info, err := r.getProcessInfo(proc)
 		if err != nil {
-			r.logger.Warnf("failed to read process info for %v", proc.PID)
+			r.logger.Debugf("failed to read process info for %v", proc.PID)
 		}
 		ret = append(ret, process_info)
 	}

x-pack/auditbeat/processors/sessionmd/provider/kerneltracingprovider/kerneltracingprovider_linux.go

@@ -211,7 +211,7 @@ func (p *prvdr) Sync(_ *beat.Event, pid uint32) error {
 func (p *prvdr) handleBackoff(now time.Time) {
 	if p.inBackoff {
 		if now.Sub(p.backoffStart) > backoffDuration {
-			p.logger.Warnw("ended backoff, skipped processes", "backoffSkipped", p.backoffSkipped)
+			p.logger.Infow("ended backoff, skipped processes", "backoffSkipped", p.backoffSkipped)
 			p.inBackoff = false
 			p.combinedWait = 0 * time.Millisecond
 		} else {
@@ -220,7 +220,7 @@ func (p *prvdr) handleBackoff(now time.Time) {
 		}
 	} else {
 		if p.combinedWait > combinedWaitLimit {
-			p.logger.Warn("starting backoff")
+			p.logger.Info("starting backoff")
 			p.inBackoff = true
 			p.backoffStart = now
 			p.backoffSkipped = 0

x-pack/auditbeat/processors/sessionmd/provider/procfsprovider/procfsprovider.go

@@ -68,7 +68,7 @@ func (p prvdr) Sync(ev *beat.Event, pid uint32) error {
 			pe.Env = procInfo.Env
 			pe.Filename = procInfo.Filename
 		} else {
-			p.logger.Warnw("couldn't get process info from proc for pid", "pid", pid, "error", err)
+			p.logger.Debugw("couldn't get process info from proc for pid", "pid", pid, "error", err)
 			// If process info couldn't be taken from procfs, populate with as much info as
 			// possible from the event
 			pe.PIDs.Tgid = pid