Filebeat fails to start on 32-bit Linux with `fatal error: runtime: netpoll failed`

[andrzej-stencel]

Basic information

Version: 7.17.15 and later, including latest 7.17.21 (7.17.14 works fine)

Operating System: 32-bit Linux (Ubuntu 16.04)

Discuss Forum URL: https://discuss.elastic.co/t/filebeat-v7-17-15-linux-binary-fails-to-start-filebeat-on-x86/347561

Steps to Reproduce

1. Download Filebeat 7.17.15 for 32-bit Linux from https://www.elastic.co/downloads/past-releases/filebeat-7-17-15
2. Unpack the archive
3. Go to the unpacked directory and run the beat

curl -LO https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.17.15-linux-x86.tar.gz
tar zxvf filebeat-7.17.15-linux-x86.tar.gz
cd filebeat-7.17.15-linux-x86
./filebeat -e > stdout.log 2> stderr.log

Actual result

The beat fails to start with empty stdout.log and the following stderr.log:

2024-05-20T11:19:54.731+0200    INFO    instance/beat.go:698    Home path: [/home/jedr/Downloads/filebeat-7.17.15-linux-x86] Config path: [/home/jedr/Downloads/filebeat-7.17.15-linux-x86] Data path: [/home/jedr/Downloads/filebeat-7.17.15-linux-x86/data] Logs path: [/home/jedr/Downloads/filebeat-7.17.15-linux-x86/logs] Hostfs Path: [/]
2024-05-20T11:19:54.732+0200    INFO    instance/beat.go:706    Beat ID: 0089b82f-70e8-48cd-9460-4a97fd93415d
2024-05-20T11:19:57.738+0200    WARN    [add_cloud_metadata]    add_cloud_metadata/provider_aws_ec2.go:79   read token request for getting IMDSv2 token returns empty: Put "http://169.254.169.254/latest/api/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers). No token in the metadata request will be used.
2024-05-20T11:19:57.745+0200    INFO    [seccomp]   seccomp/seccomp.go:124  Syscall filter successfully installed
2024-05-20T11:19:57.745+0200    INFO    [beat]  instance/beat.go:1052   Beat info   {"system_info": {"beat": {"path": {"config": "/home/jedr/Downloads/filebeat-7.17.15-linux-x86", "data": "/home/jedr/Downloads/filebeat-7.17.15-linux-x86/data", "home": "/home/jedr/Downloads/filebeat-7.17.15-linux-x86", "logs": "/home/jedr/Downloads/filebeat-7.17.15-linux-x86/logs"}, "type": "filebeat", "uuid": "0089b82f-70e8-48cd-9460-4a97fd93415d"}}}
2024-05-20T11:19:57.746+0200    INFO    [beat]  instance/beat.go:1061   Build info  {"system_info": {"build": {"commit": "b474d2803ed2961f23f614d7213d9099fb0b4354", "libbeat": "7.17.15", "time": "2023-11-08T19:08:35.000Z", "version": "7.17.15"}}}
2024-05-20T11:19:57.746+0200    INFO    [beat]  instance/beat.go:1064   Go runtime info {"system_info": {"go": {"os":"linux","arch":"386","max_procs":2,"version":"go1.20.10"}}}
runtime: epollwait on fd 3 failed with 1
fatal error: runtime: netpoll failed

runtime stack:
# removed as too long for issue body, see attached file stderr.log.

Expected result

The beat runs successfully.

Additional information

This issue apparently started on v7.17.15, as running v7.17.14 is successful.

I believe the same issue affects metricbeat, haven't checked other beats.

[elasticmachine]

Pinging @elastic/elastic-agent (Team:Elastic-Agent)

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[andrzej-stencel]

Seems to work fine on Windows 32-bit.