github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-15 21:03:54 +00:00
Code Issues Projects Releases Wiki Activity

new(metrics): enable plugins metrics

Browse Source 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
This commit is contained in:
Gianmatteo Palmieri 2024-05-30 17:39:53 +02:00 committed by poiana
parent 0e754aec14
commit 3e91a27538
4 changed files with 50 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
falco.yaml
View File

@ -1037,6 +1037,11 @@ syscall_event_drops:
# beneficial for exploring the data schema and ensuring that fields with empty
# values are included in the output.
#
# `plugins_metrics_enabled`: Falco can now expose your custom plugins'
# metrics. Please note that if the respective plugin has no metrics implemented,
# there will be no metrics available. In other words, there are no default or
# generic plugin metrics at this time. This may be subject to change.
#
# If metrics are enabled, the web server can be configured to activate the
# corresponding Prometheus endpoint using `webserver.prometheus_metrics_enabled`.
# Prometheus output can be used in combination with the other output options.
@ -1055,6 +1060,7 @@ metrics:
state_counters_enabled: true
kernel_event_counters_enabled: true
libbpf_stats_enabled: true
plugins_metrics_enabled: true
convert_memory_to_mb: true
include_empty_values: false

6
userspace/falco/configuration.cpp
View File

@ -72,7 +72,7 @@ falco_configuration::falco_configuration():
m_metrics_interval(5000),
m_metrics_stats_rule_enabled(false),
m_metrics_output_file(""),
m_metrics_flags((METRICS_V2_KERNEL_COUNTERS | METRICS_V2_LIBBPF_STATS | METRICS_V2_RESOURCE_UTILIZATION | METRICS_V2_STATE_COUNTERS | METRICS_V2_RULE_COUNTERS)),
m_metrics_flags(0),
m_metrics_convert_memory_to_mb(true),
m_metrics_include_empty_values(false)
{
@ -555,6 +555,10 @@ void falco_configuration::load_yaml(const std::string& config_name)
{
m_metrics_flags |= METRICS_V2_LIBBPF_STATS;
}
if (config.get_scalar<bool>("metrics.plugins_metrics_enabled", true))
{
m_metrics_flags |= METRICS_V2_PLUGINS;
}
m_metrics_convert_memory_to_mb = config.get_scalar<bool>("metrics.convert_memory_to_mb", true);
m_metrics_include_empty_values = config.get_scalar<bool>("metrics.include_empty_values", false);

7
userspace/falco/falco_metrics.cpp
View File

@ -222,10 +222,17 @@ std::string falco_metrics::to_text(const falco::app::state& state)
{
prometheus_metrics_converter.convert_metric_to_unit_convention(metric);
std::string namespace_name = "scap";
if (metric.flags & METRICS_V2_RESOURCE_UTILIZATION || metric.flags & METRICS_V2_KERNEL_COUNTERS)
{
namespace_name = "falco";
}
if (metric.flags & METRICS_V2_PLUGINS)
{
namespace_name = "plugins";
}
prometheus_text += prometheus_metrics_converter.convert_metric_to_text_prometheus(metric, "falcosecurity", namespace_name);
}

32
userspace/falco/stats_writer.cpp
View File

@ -440,6 +440,10 @@ void stats_writer::collector::get_metrics_output_fields_additional(
{
strlcpy(metric_name, "scap.", sizeof(metric_name));
}
if(metric.flags & METRICS_V2_PLUGINS)
{
strlcpy(metric_name, "plugins.", sizeof(metric_name));
}
strlcat(metric_name, metric.name, sizeof(metric_name));
switch (metric.type)
@ -451,6 +455,13 @@ void stats_writer::collector::get_metrics_output_fields_additional(
}
output_fields[metric_name] = metric.value.u32;
break;
case METRIC_VALUE_TYPE_S32:
if (metric.value.s32 == 0 && !m_writer->m_config->m_metrics_include_empty_values)
{
break;
}
output_fields[metric_name] = metric.value.s32;
break;
case METRIC_VALUE_TYPE_U64:
if (strncmp(metric.name, "n_evts", 7) == 0)
{
@ -492,6 +503,13 @@ void stats_writer::collector::get_metrics_output_fields_additional(
}
output_fields[metric_name] = metric.value.u64;
break;
case METRIC_VALUE_TYPE_S64:
if (metric.value.s64 == 0 && !m_writer->m_config->m_metrics_include_empty_values)
{
break;
}
output_fields[metric_name] = metric.value.s64;
break;
case METRIC_VALUE_TYPE_D:
if (metric.value.d == 0 && !m_writer->m_config->m_metrics_include_empty_values)
{
@ -499,6 +517,20 @@ void stats_writer::collector::get_metrics_output_fields_additional(
}
output_fields[metric_name] = metric.value.d;
break;
case METRIC_VALUE_TYPE_F:
if (metric.value.f == 0 && !m_writer->m_config->m_metrics_include_empty_values)
{
break;
}
output_fields[metric_name] = metric.value.f;
break;
case METRIC_VALUE_TYPE_I:
if (metric.value.i == 0 && !m_writer->m_config->m_metrics_include_empty_values)
{
break;
}
output_fields[metric_name] = metric.value.i;
break;
default:
break;
}