fix(agent): filter false events lost from go-libaudit sequence rollover

Author: yllada

agent/collector/auditd/stream.go

@@ -12,7 +12,11 @@ import (
 
 const (
 	// eventsLostThreshold - only log when this many events are lost at once.
+	// Small losses (1-10) are normal under high load and not worth logging.
 	eventsLostThreshold = 50
+
+	// eventsLostMaxReasonable is the maximum "reasonable" number of lost events.
+	eventsLostMaxReasonable = 1000000
 )
 
 // eventStream implements libaudit.Stream interface for reassembled events
@@ -59,10 +63,12 @@ func (s *eventStream) ReassemblyComplete(msgs []*auparse.AuditMessage) {
 	}
 }
 
-// EventsLost is called when events were lost due to buffer overflow
+// EventsLost is called when events were lost due to buffer overflow or rate limiting.
+// We filter these out by checking against a reasonable maximum.
 func (s *eventStream) EventsLost(count int) {
-	if count < eventsLostThreshold {
+	// Filter out unreasonable values caused by sequence number rollover bug
+	if count < eventsLostThreshold || count > eventsLostMaxReasonable {
 		return
 	}
-	utils.Logger.ErrorF("auditd: %d events lost due to buffer overflow", count)
+	utils.Logger.ErrorF("auditd: %d events lost due to buffer overflow or rate limiting", count)
 }