github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-12 14:08:27 +00:00
Code Issues Projects Releases Wiki Activity

fix(falco_metrics): remove ifinfo_json stat/metric

Browse Source 
Using JSON as value prevents any meaningful aggregation for the stats.
Splitting these information into multiple labels can drastically
increase the number of dimensions, as the number of interfaces and
addresses can be high in some environment. Moreover, these information
are not currently refreshed, even if they can frequently change. Given
these reasons, remove ifinfo_json from stats and metrics.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
This commit is contained in:
Leonardo Di Giovanna 2024-09-23 12:33:20 +02:00 committed by poiana
parent 00b35cfd81
commit 5ba94a36bd
3 changed files with 0 additions and 67 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
userspace/falco/falco_metrics.cpp
View File

@ -111,39 +111,6 @@ std::string falco_metrics::to_text(const falco::app::state& state)
prometheus_text += prometheus_metrics_converter.convert_metric_to_text_prometheus("sha256_config_files", "falcosecurity", "falco", {{"file_name", fs_path.filename()}, {"sha256", item.second}}); prometheus_text += prometheus_metrics_converter.convert_metric_to_text_prometheus("sha256_config_files", "falcosecurity", "falco", {{"file_name", fs_path.filename()}, {"sha256", item.second}});
} }
static std::string ifinfo_json_escaped;
auto ipv4list = inspector->get_ifaddr_list().get_ipv4_list();
auto ipv6list = inspector->get_ifaddr_list().get_ipv6_list();
nlohmann::json ipv4_json;
nlohmann::json ipv6_json;
if(ipv4list)
{
for (const auto& item : *ipv4list)
{
if(item.m_name == "lo")
{
continue;
}
ipv4_json[item.m_name] = item.addr_to_string();
}
}
if(ipv6list)
{
for (const auto& item : *ipv6list)
{
if(item.m_name == "lo")
{
continue;
}
ipv6_json[item.m_name] = item.addr_to_string();
}
}
nlohmann::json ifinfo_json;
ifinfo_json["ipv4"] = ipv4_json;
ifinfo_json["ipv6"] = ipv6_json;
ifinfo_json_escaped = ifinfo_json.dump();
prometheus_text += prometheus_metrics_converter.convert_metric_to_text_prometheus("host_ifinfo_json", "falcosecurity", "falco", {{"host_ifinfo_json", ifinfo_json_escaped}});
#endif #endif
for (const std::string& source: inspector->event_sources()) for (const std::string& source: inspector->event_sources())

33
userspace/falco/stats_writer.cpp
View File

@ -358,39 +358,6 @@ void stats_writer::collector::get_metrics_output_fields_wrapper(
output_fields[metric_name_file_sha256] = item.second; output_fields[metric_name_file_sha256] = item.second;
} }
auto ipv4list = inspector->get_ifaddr_list().get_ipv4_list();
auto ipv6list = inspector->get_ifaddr_list().get_ipv6_list();
nlohmann::json ipv4_json;
nlohmann::json ipv6_json;
if(ipv4list)
{
for (const auto& item : *ipv4list)
{
if(item.m_name == "lo")
{
continue;
}
ipv4_json[item.m_name] = item.addr_to_string();
}
}
if(ipv6list)
{
for (const auto& item : *ipv6list)
{
if(item.m_name == "lo")
{
continue;
}
ipv6_json[item.m_name] = item.addr_to_string();
}
}
nlohmann::json ifinfo_json;
ifinfo_json["ipv4"] = ipv4_json;
ifinfo_json["ipv6"] = ipv6_json;
m_ifinfo_json_escaped = ifinfo_json.dump();
output_fields["falco.host_ifinfo_json"] = m_ifinfo_json_escaped;
#endif #endif
output_fields["evt.source"] = src; output_fields["evt.source"] = src;
for (size_t i = 0; i < sizeof(all_driver_engines) / sizeof(const char*); i++) for (size_t i = 0; i < sizeof(all_driver_engines) / sizeof(const char*); i++)

1
userspace/falco/stats_writer.h
View File

@ -80,7 +80,6 @@ public:
uint64_t m_last_n_evts = 0; uint64_t m_last_n_evts = 0;
uint64_t m_last_n_drops = 0; uint64_t m_last_n_drops = 0;
uint64_t m_last_num_evts = 0; uint64_t m_last_num_evts = 0;
std::string m_ifinfo_json_escaped;
}; };
stats_writer(const stats_writer&) = delete; stats_writer(const stats_writer&) = delete;