Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

From what I've seen in my testing, the processor will fail to enrich a process when the process is missing from the processdb.

I have this branch with some additional logging on the error when enrichment fails, every time I've seen failure it's because the process is missing from the processdb.

There could be two potential problems here:

1. A timing issue when starting the processor. When starting, the processor with scrape procfs to fill in the process DB. There could be a gap between this scraping and when ebpf takes over, and processes will be missed from the DB. Most of the missed processes happen close to when the processor is started, so I think this is happening.
2. I've seen the enrich event run on processes that are not in the processdb, well after the processor is started. It seems like a timing issue where processes from ebpfevents are inserted into the DB after enrich has already been run on them. This could be tricky to fix, as it would need to coordinate with ebpfevents and the processor to wait for processes to be inserted before being enriched (and deal with problems like the process never being inserted)

With #39173, the problem of missing processes in the DB wasn't completely fixed.

I had a theory that the processor was getting the event before the ebpf backend had inserted it into the DB, since auditbeat and ebpf aren't synced. In this branch, when processing an event for a process that isn't in the processdb, the processor would wait for the process to be inserted. Even with a delay to wait for the process to be inserted, it never arrived. So the problem isn't a timing issue where the processor is enriching events before ebpf inserts them

One other thing to note about the original query; this includes failed exec calls from auditd (for instance the new executable file isn't found). Since the exec failed, it shouldn't be in the session viewer. This query should find the processes that should be enriched but weren't not process.entry_leader.entity_id : * and event.action : "executed" and not auditd.result: "fail"