github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-02 15:15:17 +00:00
Code Issues Projects Releases Wiki Activity

Better tracking of rule counts per ruleset (#645)

Browse Source 
Add more accurate tracking of the number of falco rules loaded per
ruleset, which are made available via the engine method
::num_rules_for_ruleset().

In the ruleset objects, keep track if a filter wrapper is actually
added/removed and if so increment/decrement the count.
This commit is contained in:
Mark Stemm
2019-06-05 13:44:50 -07:00
committed by GitHub
parent de8b92fa05
commit 43bfaecff5
4 changed files with 66 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
userspace/engine/falco_engine.cpp
View File

@@ -251,6 +251,14 @@ uint16_t falco_engine::find_ruleset_id(const std::string &ruleset)
return it->second;
}
uint64_t falco_engine::num_rules_for_ruleset(const std::string &ruleset)
{
uint16_t ruleset_id = find_ruleset_id(ruleset);
return m_sinsp_rules->num_rules_for_ruleset(ruleset_id) +
m_k8s_audit_rules->num_rules_for_ruleset(ruleset_id);
}
void falco_engine::evttypes_for_ruleset(std::vector<bool> &evttypes, const std::string &ruleset)
{
uint16_t ruleset_id = find_ruleset_id(ruleset);