Unstable FIM tests for Ubuntu agent - 4.4

[Rebits]

Version	Commit	Report
4.4.0	2daea6b	agent_ubuntu_report.zip

Description

Ubuntu agent FIM tests seem unstable. More than 300 fails with ERROR status. Probably, these are caused by a failure during test case test_events_while_integrity_scan[get_configuration1-tags_to_apply0] FAILED, in which package installation

Error installing auditd

==================================== ERRORS ====================================
_ ERROR at teardown of test_move_folders_to_realtime[get_configuration0-tags_to_apply0] _
test_fim/test_files/test_audit/test_remove_audit.py:123: in uninstall_install_audit
    process = subprocess.run([package_management, "install", audit, option], check=True)
/usr/lib/python3.6/subprocess.py:438: in run
    output=stdout, stderr=stderr)
E   subprocess.CalledProcessError: Command '['apt-get', 'install', 'auditd', '--yes']' returned non-zero exit status 100.
---------------------------- Captured stdout setup -----------------------------
Reading package lists...
Building dependency tree...
Reading state information...
The following package was automatically installed and is no longer required:
  libauparse0
Use 'sudo apt autoremove' to remove it.
The following packages will be REMOVED:
  auditd
0 upgraded, 0 newly installed, 1 to remove and 192 not upgraded.
After this operation, 651 kB disk space will be freed.
(Reading database ... 
(Reading database ... 5%
(Reading database ... 10%
(Reading database ... 15%
(Reading database ... 20%
(Reading database ... 25%
(Reading database ... 30%
(Reading database ... 35%
(Reading database ... 40%
(Reading database ... 45%
(Reading database ... 50%
(Reading database ... 55%
(Reading database ... 60%
(Reading database ... 65%
(Reading database ... 70%
(Reading database ... 75%
(Reading database ... 80%
(Reading database ... 85%
(Reading database ... 90%
(Reading database ... 95%
(Reading database ... 100%
(Reading database ... 124586 files and directories currently installed.)
Removing auditd (1:2.8.2-1ubuntu1.1) ...
Processing triggers for man-db (2.8.3-2ubuntu0.1) ...
---------------------------- Captured stderr setup -----------------------------
2022/10/01 06:08:23 wazuh-syscheckd[4647] debug_op.c:70 at _log(): DEBUG: Logging module auto-initialized
2022/10/01 06:08:23 wazuh-syscheckd[4647] config.c:33 at Read_Syscheck_Config(): DEBUG: (6287): Reading configuration file: 'etc/ossec.conf'
2022/10/01 06:08:23 wazuh-syscheckd[4647] config.c:41 at Read_Syscheck_Config(): DEBUG: (6208): Reading Client Configuration [etc/ossec.conf]
2022/10/01 06:08:23 wazuh-syscheckd[4647] agent_op.c:219 at os_read_agent_profile(): DEBUG: Calling os_read_agent_profile().
2022/10/01 06:08:23 wazuh-syscheckd[4647] agent_op.c:238 at os_read_agent_profile(): DEBUG: os_read_agent_profile() = [centos, centos7, centos7.4]
2022/10/01 06:08:23 wazuh-syscheckd[4647] config.c:424 at ReadConfig(): DEBUG: agent_config element does not have any attributes.
2022/10/01 06:08:23 wazuh-syscheckd[4647] agent_op.c:219 at os_read_agent_profile(): DEBUG: Calling os_read_agent_profile().
2022/10/01 06:08:23 wazuh-syscheckd[4647] agent_op.c:238 at os_read_agent_profile(): DEBUG: os_read_agent_profile() = [centos, centos7, centos7.4]
2022/10/01 06:08:23 wazuh-syscheckd[4647] config.c:424 at ReadConfig(): DEBUG: agent_config element does not have any attributes.
2022/10/01 06:08:23 rootcheck[4647] rootcheck.c:202 at rootcheck_init(): INFO: Rootcheck disabled.
--------------------------- Captured stdout teardown ---------------------------
2022-10-01T06:08:24.1664604504
--------------------------- Captured stderr teardown ---------------------------
E: Could not get lock /var/lib/dpkg/lock-frontend - open (11: Resource temporarily unavailable)
E: Unable to acquire the dpkg frontend lock (/var/lib/dpkg/lock-frontend), is another process using it?

[fedepacher]

Update 2022/11/01

Owing to the following error:

E: Could not get lock /var/lib/dpkg/lock-frontend - open (11: Resource temporarily unavailable)
E: Unable to acquire the dpkg frontend lock (/var/lib/dpkg/lock-frontend), is another process using it?

It concludes that the problem comes when it tries to install the audit package and for some reason the apt-get service is busy.
To solve this, it will retry to install the packages 5 times before throwing an exception, with a waiting time of 10 seconds for each try.