github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-01 03:05:25 +00:00
Code Issues Projects Releases Wiki Activity

update(metrics): introduce restart ts metric to statistically inspect restart/hot_reload conditions

Browse Source 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
This commit is contained in:
Melissa Kilby 2025-05-18 16:57:10 +00:00
parent 3191c8a80c
commit 289f003e22
No known key found for this signature in database
GPG Key ID: 62A9C53D69DA5348
4 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
userspace/falco/app/actions/load_config.cpp
View File

@ -66,6 +66,10 @@ falco::app::run_result falco::app::actions::load_config(const falco::app::state&
}
}
s.config->m_falco_restart_ts = (int64_t)std::chrono::duration_cast<std::chrono::nanoseconds>(
std::chrono::system_clock::now().time_since_epoch())
.count();
s.config->m_buffered_outputs = !s.options.unbuffered_outputs;
return apply_deprecated_options(s);

1
userspace/falco/configuration.h
View File

@ -161,6 +161,7 @@ public:
bool m_watch_config_files;
bool m_buffered_outputs;
int64_t m_falco_restart_ts;
size_t m_outputs_queue_capacity;
bool m_time_format_iso_8601;
bool m_buffer_format_base64;

8
userspace/falco/falco_metrics.cpp
View File

@ -143,6 +143,14 @@ std::string falco_metrics::to_text(const falco::app::state& state) {
}
std::vector<metrics_v2> additional_wrapper_metrics;
additional_wrapper_metrics.emplace_back(libs::metrics::libsinsp_metrics::new_metric(
"restart_ts",
METRICS_V2_MISC,
METRIC_VALUE_TYPE_S64,
METRIC_VALUE_UNIT_TIME_TIMESTAMP_NS,
METRIC_VALUE_METRIC_TYPE_NON_MONOTONIC_CURRENT,
state.config->m_falco_restart_ts));
if(agent_info) {
additional_wrapper_metrics.emplace_back(libs::metrics::libsinsp_metrics::new_metric(
"start_ts",

1
userspace/falco/stats_writer.cpp
View File

@ -354,6 +354,7 @@ void stats_writer::collector::get_metrics_output_fields_wrapper(
/* Wrapper fields useful for statistical analyses and attributions. Always enabled. */
output_fields["evt.time"] =
now; /* Some ETLs may prefer a consistent timestamp within output_fields. */
output_fields["falco.restart_ts"] = m_writer->m_config->m_falco_restart_ts;
output_fields["falco.version"] = FALCO_VERSION;
if(agent_info) {
output_fields["falco.start_ts"] = agent_info->start_ts_epoch;