Handle eventActionProcessError

elastic · Feb 14, 2025 · d040234 · d040234
1 parent ff23713
commit d040234
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/x-pack/auditbeat/module/system/process/process.go b/x-pack/auditbeat/module/system/process/process.go
@@ -139,6 +139,8 @@ func makeMessage(pid int, action eventAction, name string, username string, err
 		actionString = "RAN"
 	case eventActionProcessChangedImage:
 		actionString = "CHANGED IMAGE"
+	case eventActionProcessError: // NOTREACHABLE as err != nil if action is ProcessError
+		actionString = "ERROR"
 	}
 
 	var userString string