diff --git a/userspace/falco/app/actions/load_config.cpp b/userspace/falco/app/actions/load_config.cpp index 6523aaaa..9fe11403 100644 --- a/userspace/falco/app/actions/load_config.cpp +++ b/userspace/falco/app/actions/load_config.cpp @@ -66,6 +66,10 @@ falco::app::run_result falco::app::actions::load_config(const falco::app::state& } } + s.config->m_falco_restart_ts = (int64_t)std::chrono::duration_cast( + std::chrono::system_clock::now().time_since_epoch()) + .count(); + s.config->m_buffered_outputs = !s.options.unbuffered_outputs; return apply_deprecated_options(s); diff --git a/userspace/falco/configuration.h b/userspace/falco/configuration.h index 0f4d4ab9..b7ce8953 100644 --- a/userspace/falco/configuration.h +++ b/userspace/falco/configuration.h @@ -161,6 +161,7 @@ public: bool m_watch_config_files; bool m_buffered_outputs; + int64_t m_falco_restart_ts; size_t m_outputs_queue_capacity; bool m_time_format_iso_8601; bool m_buffer_format_base64; diff --git a/userspace/falco/falco_metrics.cpp b/userspace/falco/falco_metrics.cpp index aca5e8fd..a019e9d9 100644 --- a/userspace/falco/falco_metrics.cpp +++ b/userspace/falco/falco_metrics.cpp @@ -143,6 +143,14 @@ std::string falco_metrics::to_text(const falco::app::state& state) { } std::vector additional_wrapper_metrics; + additional_wrapper_metrics.emplace_back(libs::metrics::libsinsp_metrics::new_metric( + "restart_ts", + METRICS_V2_MISC, + METRIC_VALUE_TYPE_S64, + METRIC_VALUE_UNIT_TIME_TIMESTAMP_NS, + METRIC_VALUE_METRIC_TYPE_NON_MONOTONIC_CURRENT, + state.config->m_falco_restart_ts)); + if(agent_info) { additional_wrapper_metrics.emplace_back(libs::metrics::libsinsp_metrics::new_metric( "start_ts", diff --git a/userspace/falco/stats_writer.cpp b/userspace/falco/stats_writer.cpp index 8d6dee4a..8901ffbb 100644 --- a/userspace/falco/stats_writer.cpp +++ b/userspace/falco/stats_writer.cpp @@ -354,6 +354,7 @@ void stats_writer::collector::get_metrics_output_fields_wrapper( /* Wrapper fields useful for statistical analyses and attributions. Always enabled. */ output_fields["evt.time"] = now; /* Some ETLs may prefer a consistent timestamp within output_fields. */ + output_fields["falco.restart_ts"] = m_writer->m_config->m_falco_restart_ts; output_fields["falco.version"] = FALCO_VERSION; if(agent_info) { output_fields["falco.start_ts"] = agent_info->start_ts_epoch;