Windows: Auditbeat/file_integrity reports "short read in readEvents()"

[adriansr]

For confirmed bugs, please report:

• Version: 7.11
• Operating System: Windows 2016
• Discuss Forum URL:
• Steps to Reproduce:

With this config:

auditbeat.modules:
- module: file_integrity
  paths:
  - 'C:/users'
  recursive: true
  scan_at_start: false

Running under Windows (tested on 2016), the following warning appears periodically in Auditbeat's log:

WARN    [file_integrity]        file_integrity/eventreader_fsnotify.go:153      fsnotify watcher error  {"error": "short read in readEvents()"}
WARN    [file_integrity]        file_integrity/eventreader_fsnotify.go:153      fsnotify watcher error  {"error": "short read in readEvents()"}
WARN    [file_integrity]        file_integrity/eventreader_fsnotify.go:153      fsnotify watcher error  {"error": "short read in readEvents()"}

Seems to be the same issue as in: fsnotify/fsnotify#72

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[oscar-sanchez-ekasa]

Update fsnotify to version 1.6.0 to apply the change "windows: increase buffer size from 4K to 64K" (fsnotify/fsnotify#485)