[Flaky Test] auditbeat.tests.system.test_file_integrity.Test test_file_modified__kprobes

{
  "id": "c77ad58f-3c6e-8099-8242-f7a759115be7",
  "web_url": "https://buildkite.com/organizations/elastic/analytics/suites/beats/tests/c77ad58f-3c6e-8099-8242-f7a759115be7",
  "scope": "auditbeat.tests.system.test_file_integrity.Test",
  "name": "test_file_modified__kprobes",
  "location": "auditbeat/tests/system/test_file_integrity.py:352",
  "file_name": "auditbeat/tests/system/test_file_integrity.py",
  "instances": 2,
  "latest_occurrence_at": "2026-05-18T07:25:04.560Z",
  "most_recent_instance_at": "2026-05-18T07:25:04.560Z",
  "last_resolved_at": null,
  "ownership_team_ids": [],
  "failure_examples_count": 1
}

self = <test_file_integrity.Test testMethod=test_file_modified__kprobes>

    @unittest.skipUnless(is_platform_supported(), "Requires Linux 3.10.0+ and arm64/amd64 arch")
    @unittest.skipUnless(is_root(), "Requires root")
    def test_file_modified__kprobes(self):
>       self._test_file_modified("kprobes")

tests/system/test_file_integrity.py:356: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
tests/system/test_file_integrity.py:314: in _test_file_modified
    self.wait_output(1)
tests/system/test_file_integrity.py:84: in wait_output
    self.wait_until(lambda: wrap_except(lambda: len(self.read_output()) >= min_events))
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <test_file_integrity.Test testMethod=test_file_modified__kprobes>, cond = <function Test.wait_output.<locals>.<lambda> at 0xffff8f4649a0>
max_timeout = 20, poll_interval = 0.1, name = 'cond', err_msg = ''

    def wait_until(self, cond, max_timeout=20, poll_interval=0.1, name="cond", err_msg=""):
        """
        TODO: this can probably be a "wait_until_output_count", among other things, since that could actually use `self`, and this can become an internal function
        Waits until the cond function returns true,
        or until the max_timeout is reached. Calls the cond
        function every poll_interval seconds.
    
        If the max_timeout is reached before cond() returns
        true, an exception is raised.
        """
        start = datetime.now()
        while not cond():
            if datetime.now() - start > timedelta(seconds=max_timeout):
                print("Test has failed, here are the Beat logs")
                if self.output_lines() == 0:
                    print("\n\nBeat had no output file")
                else:
                    print("\n\nHere is the beat's output file:")
                    for entry in self.read_output():
                        print(entry)
>               raise WaitTimeoutError(
                    f"Timeout waiting for condition '{name}'. Waited {max_timeout} seconds: {err_msg}")
E               beat.beat.WaitTimeoutError: Timeout waiting for condition 'cond'. Waited 20 seconds:

../libbeat/tests/system/beat/beat.py:453: WaitTimeoutError