github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-01 09:02:18 +00:00
Code Issues Projects Releases Wiki Activity

new(userspace/falco): stats v2 config option to convert memory metrics to MB

Browse Source 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
This commit is contained in:
Melissa Kilby 2023-04-27 15:17:22 +00:00 committed by poiana
parent 010e45a4af
commit 134d2630e9
4 changed files with 23 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
falco.yaml
View File

@ -617,9 +617,10 @@ base_syscalls:
# Emit CPU and memory usages. CPU usage is percentage of one CPU, # Emit CPU and memory usages. CPU usage is percentage of one CPU,
# can be normalized to total number of CPUs to determine overall usage. # can be normalized to total number of CPUs to determine overall usage.
# Memory metrics are currently kept in raw units, `kb` for RSS, PSS and VSZ # Memory metrics are currently kept in raw units, `kb` for RSS, PSS and VSZ
# or `bytes` for container_memory_used. # or `bytes` for container_memory_used. Use `convert_memory_to_mb` to
# `-E FALCO_CGROUP_MEM=customfile` let's you customize container_memory_used # uniformly convert each memory metric to MB.
# which defaults to Kubernetes `/sys/fs/cgroup/memory/memory.usage_in_bytes`. # `-E FALCO_CGROUP_MEM=customfile` let's you customize the container_memory_used
# file which defaults to Kubernetes `/sys/fs/cgroup/memory/memory.usage_in_bytes`.
# #
# `include_kernel_evts_counters`: # `include_kernel_evts_counters`:
# Emit kernel side event and drop counters, compare to `syscall_event_drops`, # Emit kernel side event and drop counters, compare to `syscall_event_drops`,
@ -644,3 +645,4 @@ stats_v2:
include_resource_utilization: true include_resource_utilization: true
include_kernel_evts_counters: true include_kernel_evts_counters: true
include_libbpf_stats: true include_libbpf_stats: true
convert_memory_to_mb: true

1
userspace/falco/configuration.cpp
View File

@ -347,6 +347,7 @@ void falco_configuration::load_yaml(const std::string& config_name, const yaml_h
m_stats_v2_include_resource_utilization = config.get_scalar<bool>("stats_v2.include_resource_utilization", true); m_stats_v2_include_resource_utilization = config.get_scalar<bool>("stats_v2.include_resource_utilization", true);
m_stats_v2_include_kernel_evts_counters = config.get_scalar<bool>("stats_v2.include_kernel_evts_counters", true); m_stats_v2_include_kernel_evts_counters = config.get_scalar<bool>("stats_v2.include_kernel_evts_counters", true);
m_stats_v2_include_libbpf_stats = config.get_scalar<bool>("stats_v2.include_libbpf_stats", true); m_stats_v2_include_libbpf_stats = config.get_scalar<bool>("stats_v2.include_libbpf_stats", true);
m_stats_v2_convert_memory_to_mb = config.get_scalar<bool>("stats_v2.convert_memory_to_mb", true);
std::vector<std::string> load_plugins; std::vector<std::string> load_plugins;

1
userspace/falco/configuration.h
View File

@ -121,6 +121,7 @@ public:
bool m_stats_v2_include_resource_utilization; bool m_stats_v2_include_resource_utilization;
bool m_stats_v2_include_kernel_evts_counters; bool m_stats_v2_include_kernel_evts_counters;
bool m_stats_v2_include_libbpf_stats; bool m_stats_v2_include_libbpf_stats;
bool m_stats_v2_convert_memory_to_mb;
std::vector<plugin_config> m_plugins; std::vector<plugin_config> m_plugins;

14
userspace/falco/stats_writer.cpp
View File

@ -225,10 +225,24 @@ std::map<std::string, std::string> stats_writer::collector::get_stats_v2_output_
switch(utilization[stat].type) switch(utilization[stat].type)
{ {
case STATS_VALUE_TYPE_U64: case STATS_VALUE_TYPE_U64:
if (m_writer->m_config->m_stats_v2_convert_memory_to_mb && strncmp(utilization[stat].name, "container_memory_used", 21) == 0)
{
output_fields[utilization[stat].name] = std::to_string(utilization[stat].value.u64 / (double)1024 / (double)1024);
}
else
{
output_fields[utilization[stat].name] = std::to_string(utilization[stat].value.u64); output_fields[utilization[stat].name] = std::to_string(utilization[stat].value.u64);
}
break; break;
case STATS_VALUE_TYPE_U32: case STATS_VALUE_TYPE_U32:
if (m_writer->m_config->m_stats_v2_convert_memory_to_mb && strncmp(utilization[stat].name, "memory_", 7) == 0)
{
output_fields[utilization[stat].name] = std::to_string(utilization[stat].value.u32 / (double)1024);
}
else
{
output_fields[utilization[stat].name] = std::to_string(utilization[stat].value.u32); output_fields[utilization[stat].name] = std::to_string(utilization[stat].value.u32);
}
break; break;
case STATS_VALUE_TYPE_D: case STATS_VALUE_TYPE_D:
output_fields[utilization[stat].name] = std::to_string(utilization[stat].value.d); output_fields[utilization[stat].name] = std::to_string(utilization[stat].value.d);