github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-19 14:47:04 +00:00
Code Issues Projects Releases Wiki Activity

chore: fix formatting

Browse Source 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
This commit is contained in:
Leonardo Grasso 2025-07-18 15:07:48 +02:00 committed by poiana
parent 81f26b7e5d
commit 63d27fbe1b
7 changed files with 67 additions and 66 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
userspace/engine/rule_loader.h
View File

@ -482,8 +482,8 @@ struct rule_update_info {
bool has_any_value() {
return cond.has_value() || output.has_value() || desc.has_value() || tags.has_value() ||
exceptions.has_value() || priority.has_value() || enabled.has_value() ||
capture.has_value() || capture_duration.has_value() ||
warn_evttypes.has_value() || skip_if_unknown_filter.has_value();
capture.has_value() || capture_duration.has_value() || warn_evttypes.has_value() ||
skip_if_unknown_filter.has_value();
}
context ctx;

18
userspace/falco/app/actions/process_events.cpp
View File

@ -303,7 +303,8 @@ static falco::app::run_result do_inspect(
// the outputs.
auto res = s.engine->process_event(source_engine_idx, ev, s.config->m_rule_matching);
if(res != nullptr) {
auto capture = s.config->m_capture_enabled && capture_mode_t::ALL_RULES == s.config->m_capture_mode;
auto capture = s.config->m_capture_enabled &&
capture_mode_t::ALL_RULES == s.config->m_capture_mode;
for(auto& rule_res : *res) {
// Process output
s.outputs->handle_event(rule_res.evt,
@ -325,10 +326,13 @@ static falco::app::run_result do_inspect(
}
}
// When a rule matches or we are in all_rules mode, we start a dump (if not in progress yet)
// When a rule matches or we are in all_rules mode, we start a dump (if not in progress
// yet)
if(capture && dump_started_ts == 0) {
dumper->open(inspector.get(),
generate_scap_file_path(s.config->m_capture_path_prefix, ev->get_ts(), ev->get_num()),
generate_scap_file_path(s.config->m_capture_path_prefix,
ev->get_ts(),
ev->get_num()),
true); // Enable compression
dump_started_ts = ev->get_ts();
// If no rule has set a deadline, use the default one
@ -338,7 +342,6 @@ static falco::app::run_result do_inspect(
}
}
// Save events when a dump is in progress.
// If the deadline is reached, close the dump.
if(dump_started_ts != 0) {
@ -500,10 +503,9 @@ falco::app::run_result falco::app::actions::process_events(falco::app::state& s)
default:
ASSERT(false);
}
falco_logger::log(
falco_logger::level::INFO,
"Capture is enabled in mode " + capture_mode +
". Capturing events to " + s.config->m_capture_path_prefix + "\n");
falco_logger::log(falco_logger::level::INFO,
"Capture is enabled in mode " + capture_mode + ". Capturing events to " +
s.config->m_capture_path_prefix + "\n");
}
// Start processing events

4
userspace/falco/configuration.cpp
View File

@ -641,7 +641,6 @@ void falco_configuration::load_yaml(const std::string &config_name) {
m_metrics_include_empty_values =
m_config.get_scalar<bool>("metrics.include_empty_values", false);
m_capture_enabled = m_config.get_scalar<bool>("capture.enabled", false);
m_capture_path_prefix = m_config.get_scalar<std::string>("capture.path_prefix", "/tmp/falco");
// Set capture mode if not already set.
@ -659,7 +658,8 @@ void falco_configuration::load_yaml(const std::string &config_name) {
}
// Convert to nanoseconds
m_capture_default_duration_ns = m_config.get_scalar<uint32_t>("capture.default_duration", 5000) * 1000000LL;
m_capture_default_duration_ns =
m_config.get_scalar<uint32_t>("capture.default_duration", 5000) * 1000000LL;
m_plugins_hostinfo = m_config.get_scalar<bool>("plugins_hostinfo", true);

1
userspace/falco/configuration.h
View File

@ -215,7 +215,6 @@ public:
capture_mode_t m_capture_mode = capture_mode_t::RULES;
u_int64_t m_capture_default_duration_ns;
// Falco engine
engine_kind_t m_engine_mode = engine_kind_t::KMOD;
kmod_config m_kmod = {};