github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-19 09:06:48 +00:00
Code Issues Projects Releases Wiki Activity

cleanup(metrics): simplify logic around immediate metrics logging after start/reload

Browse Source 
* For consistency don't make first run metrics log special
* Remove firt tick variable altogether to enable metrics logging immediately after startup/reload

Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
This commit is contained in:
Melissa Kilby 2025-05-21 15:12:50 +00:00 committed by poiana
parent 22d40e2a65
commit 309ccf65d3
2 changed files with 31 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
userspace/falco/stats_writer.cpp
View File

@ -233,7 +233,6 @@ void stats_writer::worker() noexcept {
bool use_file = !m_config->m_metrics_output_file.empty();
auto tick = stats_writer::get_ticker();
auto last_tick = tick;
auto first_tick = tick;
while(true) {
// blocks until a message becomes availables
@ -244,37 +243,34 @@ void stats_writer::worker() noexcept {
return;
}
// this helps waiting for the first tick
tick = stats_writer::get_ticker();
if(m_first_run || first_tick != tick) {
if(last_tick != tick) {
m_total_samples++;
}
last_tick = tick;
try {
if(use_outputs) {
std::string rule = "Falco internal: metrics snapshot";
std::string msg = "Falco metrics snapshot";
m_outputs->handle_msg(m.ts,
falco_common::PRIORITY_INFORMATIONAL,
msg,
rule,
m.output_fields);
}
if(use_file) {
nlohmann::json jmsg;
jmsg["sample"] = m_total_samples;
jmsg["output_fields"] = m.output_fields;
m_file_output << jmsg.dump() << std::endl;
}
} catch(const std::exception& e) {
falco_logger::log(falco_logger::level::ERR,
"stats_writer (worker): " + std::string(e.what()) + "\n");
}
if(last_tick != tick) {
m_total_samples++;
}
last_tick = tick;
try {
if(use_outputs) {
std::string rule = "Falco internal: metrics snapshot";
std::string msg = "Falco metrics snapshot";
m_outputs->handle_msg(m.ts,
falco_common::PRIORITY_INFORMATIONAL,
msg,
rule,
m.output_fields);
}
if(use_file) {
nlohmann::json jmsg;
jmsg["sample"] = m_total_samples;
jmsg["output_fields"] = m.output_fields;
m_file_output << jmsg.dump() << std::endl;
}
} catch(const std::exception& e) {
falco_logger::log(falco_logger::level::ERR,
"stats_writer (worker): " + std::string(e.what()) + "\n");
}
m_first_run = false;
}
}
@ -640,7 +636,7 @@ void stats_writer::collector::collect(const std::shared_ptr<sinsp>& inspector,
#endif
/* Collect stats / metrics once per ticker period. */
auto tick = stats_writer::get_ticker();
if(m_first_run || tick != m_last_tick) {
if(tick != m_last_tick) {
m_last_tick = tick;
auto now = std::chrono::duration_cast<std::chrono::nanoseconds>(
std::chrono::system_clock::now().time_since_epoch())
@ -661,10 +657,8 @@ void stats_writer::collector::collect(const std::shared_ptr<sinsp>& inspector,
num_evts,
now,
stats_snapshot_time_delta_sec);
if(!m_first_run) {
get_metrics_output_fields_additional(output_fields, stats_snapshot_time_delta_sec);
}
m_first_run = false;
get_metrics_output_fields_additional(output_fields, stats_snapshot_time_delta_sec);
/* Send message in the queue */
stats_writer::msg msg;

6
userspace/falco/stats_writer.h
View File

@ -82,8 +82,9 @@ public:
double stats_snapshot_time_delta_sec);
std::shared_ptr<stats_writer> m_writer;
bool m_first_run = true;
stats_writer::ticker_t m_last_tick = 0;
// Init m_last_tick w/ invalid value to enable metrics logging immediately after
// startup/reload
stats_writer::ticker_t m_last_tick = -1;
uint64_t m_last_now = 0;
uint64_t m_last_n_evts = 0;
uint64_t m_last_n_drops = 0;
@ -145,7 +146,6 @@ private:
inline void push(const stats_writer::msg& m);
bool m_initialized = false;
bool m_first_run = true;
uint64_t m_total_samples = 0;
std::thread m_worker;
std::ofstream m_file_output;