[CI] CliSecurityIT class failing

[elasticsearchmachine]

Build Scans:

• elasticsearch-periodic-platform-support #6169 / windows-2022_checkpart2_platform-support-windows
• elasticsearch-periodic-platform-support #6106 / windows-2019_checkpart2_platform-support-windows

Reproduction Line:

gradlew ':x-pack:plugin:sql:qa:server:security:with-ssl:javaRestTest' --tests "org.elasticsearch.xpack.sql.qa.security.CliSecurityIT.testDescribeDocumentExcluded" -Dtests.seed=439579546A25FCCC -Dtests.locale=fr-FR -Dtests.timezone=Pacific/Galapagos -Druntime.java=22

Applicable branches:
7.17

Reproduces locally?:
N/A

Failure History:
See dashboard

Failure Message:

java.lang.AssertionError: Some checkers [0, 1, 2, 3] didn't match any logs. All logs:  none!
Remaining logs:  none!

Issue Reasons:

• [7.17] 2 failures in class org.elasticsearch.xpack.sql.qa.security.CliSecurityIT (0.5% fail rate in 443 executions)
• [7.17] 2 failures in pipeline elasticsearch-periodic-platform-support (20.0% fail rate in 10 executions)

Note:
This issue was created using new test triage automation. Please report issues or feedback to es-delivery.

[elasticsearchmachine]

Pinging @elastic/es-analytical-engine (Team:Analytics)

[alex-spies]

Doesn't reproduce locally.

The last time this came up was in 2021: #73657

Back then, we said that it's likely flakiness due to rollover of audit logs when the tests are executed close to the top of the hour. Might be the same here, the tests are closely after the beginning of an hour:

First build scan:
[2025-02-03T18:00:10,503][WARN ][o.e.x.s.q.s.CliSecurityIT] [testDescribeDocumentExcluded] Failed to find an audit log. Skipping remaining tests in this class after this the missing auditlogs could turn up later.	

Second build scan:
[2025-01-31T21:00:10,615][WARN ][o.e.x.s.q.s.CliSecurityIT] [testQuerySingleFieldGranted] Failed to find an audit log. Skipping remaining tests in this class after this the missing auditlogs could turn up later.	

Because of this, I think this is a low risk problem (unless this gets auto-muted in the future).

@astefan , for good measure, could you please double check my reasoning as you've worked on this problem in the past?

[astefan]

These tests were very hard to reproduce for me, actually I don't believe I managed to repro them ever. Unless these happen frequently, low-risk label is the right one.