diff --git a/cmake/modules/falcosecurity-libs.cmake b/cmake/modules/falcosecurity-libs.cmake index 86738096..2c96473f 100644 --- a/cmake/modules/falcosecurity-libs.cmake +++ b/cmake/modules/falcosecurity-libs.cmake @@ -53,6 +53,8 @@ if(MUSL_OPTIMIZED_BUILD) endif() set(SCAP_HOST_ROOT_ENV_VAR_NAME "HOST_ROOT") +set(SCAP_HOSTNAME_ENV_VAR "FALCO_HOSTNAME") +set(SINSP_AGENT_CGROUP_MEM_PATH_ENV_VAR "FALCO_CGROUP_MEM") if(NOT LIBSCAP_DIR) set(LIBSCAP_DIR "${FALCOSECURITY_LIBS_SOURCE_DIR}") diff --git a/falco.yaml b/falco.yaml index eab7fb6f..d1bc346c 100644 --- a/falco.yaml +++ b/falco.yaml @@ -585,6 +585,9 @@ base_syscalls: # # Disabled by default. # +# Env variable `-E FALCO_HOSTNAME=myhostname` customizes hostname in case +# you deploy in Kubernetes where the hostname can be equivalent to the pod name. +# # `stats_interval_preset`: # preset 0: default -> means skip, not enabled # preset 1: 15 -> 900000 @@ -613,7 +616,10 @@ base_syscalls: # `include_resource_utilization`: # Emit CPU and memory usages. CPU usage is percentage of one CPU, # can be normalized to total number of CPUs to determine overall usage. -# Memory metrics are currently kept in raw units, kb or bytes. +# Memory metrics are currently kept in raw units, `kb` for RSS, PSS and VSZ +# or `bytes` for container_memory_used. +# `-E FALCO_CGROUP_MEM=customfile` let's you customize container_memory_used +# which defaults to Kubernetes `/sys/fs/cgroup/memory/memory.usage_in_bytes`. # # `include_kernel_evts_counters`: # Emit kernel side event and drop counters, compare to `syscall_event_drops`,