github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-13 06:24:29 +00:00
Code Issues Projects Releases Wiki Activity

Add stats on events processed/dropped.

Browse Source 
Collect stats on the number of events processed and dropped. When run
with -v, print these stats. This duplicates syddig behavior and can be
useful when dianosing problems related to dropped events throwing off
internal state tracking.
This commit is contained in:
Mark Stemm 2016-10-21 15:30:47 -07:00
parent e0e640c67f
commit 0211a94f60
1 changed files with 34 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
userspace/falco/falco.cpp
View File

@ -122,10 +122,11 @@ std::list<string> cmdline_options;
//
// Event processing loop
//
void do_inspect(falco_engine *engine,
falco_outputs *outputs,
sinsp* inspector)
uint64_t do_inspect(falco_engine *engine,
falco_outputs *outputs,
sinsp* inspector)
{
uint64_t num_evts = 0;
int32_t res;
sinsp_evt* ev;
@ -176,7 +177,11 @@ void do_inspect(falco_engine *engine,
outputs->handle_event(res->evt, res->rule, res->priority, res->format);
delete(res);
}
num_evts++;
}
return num_evts;
}
//
@ -213,6 +218,11 @@ int falco_init(int argc, char **argv)
unsigned long event_limit = 0L;
bool compress = false;
// Used for stats
uint64_t num_evts;
double duration;
scap_stats cstats;
static struct option long_options[] =
{
{"help", no_argument, 0, 'h' },
@ -518,6 +528,8 @@ int falco_init(int argc, char **argv)
inspector->autodump_next_file();
}
duration = ((double)clock()) / CLOCKS_PER_SEC;
//
// run k8s, if required
//
@ -575,9 +587,25 @@ int falco_init(int argc, char **argv)
delete mesos_api;
mesos_api = 0;
do_inspect(engine,
outputs,
inspector);
num_evts = do_inspect(engine,
outputs,
inspector);
duration = ((double)clock()) / CLOCKS_PER_SEC - duration;
inspector->get_capture_stats(&cstats);
if(verbose)
{
fprintf(stderr, "Driver Events:%" PRIu64 "\nDriver Drops:%" PRIu64 "\n",
cstats.n_evts,
cstats.n_drops);
fprintf(stderr, "Elapsed time: %.3lf, Captured Events: %" PRIu64 ", %.2lf eps\n",
duration,
num_evts,
num_evts / duration);
}
inspector->close();