mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-21 19:44:57 +00:00
new(test): test cases about wrong threshold drop config value
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
This commit is contained in:
committed by
poiana
parent
3842e07422
commit
920ab6982a
12
test/confs/drops_threshold_neg.yaml
Normal file
12
test/confs/drops_threshold_neg.yaml
Normal file
@@ -0,0 +1,12 @@
|
||||
syscall_event_drops:
|
||||
threshold: -1
|
||||
actions:
|
||||
- ignore
|
||||
rate: .03333
|
||||
max_burst: 10
|
||||
simulate_drops: true
|
||||
|
||||
stdout_output:
|
||||
enabled: true
|
||||
|
||||
log_stderr: true
|
12
test/confs/drops_threshold_oor.yaml
Normal file
12
test/confs/drops_threshold_oor.yaml
Normal file
@@ -0,0 +1,12 @@
|
||||
syscall_event_drops:
|
||||
threshold: 1.1
|
||||
actions:
|
||||
- ignore
|
||||
rate: .03333
|
||||
max_burst: 10
|
||||
simulate_drops: true
|
||||
|
||||
stdout_output:
|
||||
enabled: true
|
||||
|
||||
log_stderr: true
|
@@ -1236,6 +1236,24 @@ trace_files: !mux
|
||||
stderr_contains:
|
||||
- "syscall event drop action \"log\" does not make sense with the \"ignore\" action"
|
||||
|
||||
monitor_syscall_drops_threshold_oor:
|
||||
exit_status: 1
|
||||
rules_file:
|
||||
- rules/single_rule.yaml
|
||||
conf_file: confs/drops_threshold_oor.yaml
|
||||
trace_file: trace_files/ping_sendto.scap
|
||||
stderr_contains:
|
||||
- "syscall event drops threshold must be a double in the range"
|
||||
|
||||
monitor_syscall_drops_threshold_neg:
|
||||
exit_status: 1
|
||||
rules_file:
|
||||
- rules/single_rule.yaml
|
||||
conf_file: confs/drops_threshold_neg.yaml
|
||||
trace_file: trace_files/ping_sendto.scap
|
||||
stderr_contains:
|
||||
- "syscall event drops threshold must be a double in the range"
|
||||
|
||||
monitor_syscall_drops_log:
|
||||
exit_status: 0
|
||||
rules_file:
|
||||
|
Reference in New Issue
Block a user