github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-29 16:17:32 +00:00
Code Issues Projects Releases Wiki Activity

update(test): tighten the condition to test the drops thresholds

Browse Source 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
This commit is contained in:
Leonardo Di Donato 2021-03-22 13:51:09 +00:00 committed by poiana
parent 7edd965a08
commit 1ded30f173
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
test/falco_tests.yaml
View File

@ -1233,6 +1233,12 @@ trace_files: !mux
- rules/single_rule.yaml - rules/single_rule.yaml
conf_file: confs/drops_ignore_log.yaml conf_file: confs/drops_ignore_log.yaml
trace_file: trace_files/ping_sendto.scap trace_file: trace_files/ping_sendto.scap
stderr_not_contains:
- "event drop detected: 9 occurrences"
- "num times actions taken: 9"
- "Falco internal: syscall event drop"
stdout_not_contains:
- "Falco internal: syscall event drop"
stderr_contains: stderr_contains:
- "syscall event drop action \"log\" does not make sense with the \"ignore\" action" - "syscall event drop action \"log\" does not make sense with the \"ignore\" action"
@ -1242,6 +1248,12 @@ trace_files: !mux
- rules/single_rule.yaml - rules/single_rule.yaml
conf_file: confs/drops_threshold_oor.yaml conf_file: confs/drops_threshold_oor.yaml
trace_file: trace_files/ping_sendto.scap trace_file: trace_files/ping_sendto.scap
stderr_not_contains:
- "event drop detected: 9 occurrences"
- "num times actions taken: 9"
- "Falco internal: syscall event drop"
stdout_not_contains:
- "Falco internal: syscall event drop"
stderr_contains: stderr_contains:
- "syscall event drops threshold must be a double in the range" - "syscall event drops threshold must be a double in the range"
@ -1251,6 +1263,12 @@ trace_files: !mux
- rules/single_rule.yaml - rules/single_rule.yaml
conf_file: confs/drops_threshold_neg.yaml conf_file: confs/drops_threshold_neg.yaml
trace_file: trace_files/ping_sendto.scap trace_file: trace_files/ping_sendto.scap
stderr_not_contains:
- "event drop detected: 9 occurrences"
- "num times actions taken: 9"
- "Falco internal: syscall event drop"
stdout_not_contains:
- "Falco internal: syscall event drop"
stderr_contains: stderr_contains:
- "syscall event drops threshold must be a double in the range" - "syscall event drops threshold must be a double in the range"