github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-04 08:04:49 +00:00
Code Issues Projects Releases Wiki Activity

new(userspace/falco): output msg when the number of consecutive timeouts without an event is greater than a given threshold

Browse Source 
The rationale is that in case Falco obtains a consistent number of
consecutive timeouts (in a row) without a valid event, something is
going wrong.

This because, normally, the libs send timeouts to Falco (also) to signal events to discard.
In such cases, which are the majority of cases, `ev` exists and is not
`null`.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
This commit is contained in:
Leonardo Di Donato
2021-04-15 10:30:58 +00:00
committed by poiana
parent 46425b392c
commit 65a168ab5a
1 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
userspace/falco/falco.cpp
View File

@@ -252,6 +252,7 @@ uint64_t do_inspect(falco_engine *engine,
sinsp_evt* ev; sinsp_evt* ev;
StatsFileWriter writer; StatsFileWriter writer;
uint64_t duration_start = 0; uint64_t duration_start = 0;
uint64_t timeouts_since_last_success_or_msg = 0;
sdropmgr.init(inspector, sdropmgr.init(inspector,
outputs, outputs,
@@ -299,6 +300,19 @@ uint64_t do_inspect(falco_engine *engine,
} }
else if(rc == SCAP_TIMEOUT) else if(rc == SCAP_TIMEOUT)
{ {
if(ev == nullptr)
{
timeouts_since_last_success_or_msg++;
if(timeouts_since_last_success_or_msg > 100)
{
std::string rule = "Falco internal: timeouts notification";
std::string msg = rule + ". 100 consecutive timeouts without event.";
std::map<std::string, std::string> of;
outputs->handle_msg(duration_start, falco_common::PRIORITY_DEBUG, msg, rule, of);
timeouts_since_last_success_or_msg = 0;
}
}
continue; continue;
} }
else if(rc == SCAP_EOF) else if(rc == SCAP_EOF)
@@ -309,16 +323,17 @@ uint64_t do_inspect(falco_engine *engine,
{ {
// //
// Event read error. // Event read error.
// Notify the chisels that we're exiting, and then die with an error.
// //
cerr << "rc = " << rc << endl; cerr << "rc = " << rc << endl;
throw sinsp_exception(inspector->getlasterr().c_str()); throw sinsp_exception(inspector->getlasterr().c_str());
} }
if (duration_start == 0) timeouts_since_last_success_or_msg = 0;
if(duration_start == 0)
{ {
duration_start = ev->get_ts(); duration_start = ev->get_ts();
} else if(duration_to_tot_ns > 0) }
else if(duration_to_tot_ns > 0)
{ {
if(ev->get_ts() - duration_start >= duration_to_tot_ns) if(ev->get_ts() - duration_start >= duration_to_tot_ns)
{ {