github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-15 23:36:19 +00:00
Code Issues Projects Releases Wiki Activity

fix(userspace/falco): when collecting metrics for stats_writer, create a libs_metrics_collector for each source.

Browse Source 
In case multiple sources are enabled, each source has its own `libs_metrics_collector`
with correct flags, so that it can retrieve all metrics.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
This commit is contained in:
Federico Di Pierro 2025-05-29 09:19:33 +02:00
parent 5d734e3f7d
commit 9d543c7039
3 changed files with 16 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
userspace/falco/app/actions/process_events.cpp
View File

@ -235,12 +235,6 @@ static falco::app::run_result do_inspect(
} }
// for capture mode, the source name can change at every event // for capture mode, the source name can change at every event
// TODO: This may currently cause issues for multiple event sources. We are deferring
// the fix to Falco 0.42.0.
// For multiple event sources, it generates `n` metrics logs per source at a time, as
// expected, with the engine_name correctly reflected. However, the order may interfere,
// as the correct inspector for the syscalls event source seems to never get passed,
// resulting in most metrics being missing.
stats_collector.collect(inspector, stats_collector.collect(inspector,
inspector->event_sources()[source_engine_idx], inspector->event_sources()[source_engine_idx],
num_evts); num_evts);

18
userspace/falco/stats_writer.cpp
View File

@ -414,7 +414,8 @@ void stats_writer::collector::get_metrics_output_fields_wrapper(
void stats_writer::collector::get_metrics_output_fields_additional( void stats_writer::collector::get_metrics_output_fields_additional(
nlohmann::json& output_fields, nlohmann::json& output_fields,
double stats_snapshot_time_delta_sec) { double stats_snapshot_time_delta_sec,
const std::string& src) {
// Falco metrics categories // Falco metrics categories
// //
// rules_counters_enabled // rules_counters_enabled
@ -478,7 +479,8 @@ void stats_writer::collector::get_metrics_output_fields_additional(
#endif #endif
#if defined(__linux__) and !defined(MINIMAL_BUILD) and !defined(__EMSCRIPTEN__) #if defined(__linux__) and !defined(MINIMAL_BUILD) and !defined(__EMSCRIPTEN__)
if(m_writer->m_libs_metrics_collector && m_writer->m_output_rule_metrics_converter) { if(m_writer->m_libs_metrics_collectors.find(src) != m_writer->m_libs_metrics_collectors.end() &&
m_writer->m_output_rule_metrics_converter) {
// Libs metrics categories // Libs metrics categories
// //
// resource_utilization_enabled // resource_utilization_enabled
@ -487,8 +489,9 @@ void stats_writer::collector::get_metrics_output_fields_additional(
// libbpf_stats_enabled // libbpf_stats_enabled
// Refresh / New snapshot // Refresh / New snapshot
m_writer->m_libs_metrics_collector->snapshot(); auto& libs_metrics_collector = m_writer->m_libs_metrics_collectors[src];
auto metrics_snapshot = m_writer->m_libs_metrics_collector->get_metrics(); libs_metrics_collector->snapshot();
auto metrics_snapshot = libs_metrics_collector->get_metrics();
// Cache n_evts and n_drops to derive n_drops_perc. // Cache n_evts and n_drops to derive n_drops_perc.
uint64_t n_evts = 0; uint64_t n_evts = 0;
uint64_t n_drops = 0; uint64_t n_drops = 0;
@ -611,7 +614,8 @@ void stats_writer::collector::collect(const std::shared_ptr<sinsp>& inspector,
uint64_t num_evts) { uint64_t num_evts) {
if(m_writer->has_output()) { if(m_writer->has_output()) {
#if defined(__linux__) and !defined(MINIMAL_BUILD) and !defined(__EMSCRIPTEN__) #if defined(__linux__) and !defined(MINIMAL_BUILD) and !defined(__EMSCRIPTEN__)
if(!m_writer->m_libs_metrics_collector) { if(m_writer->m_libs_metrics_collectors.find(src) ==
m_writer->m_libs_metrics_collectors.end()) {
uint32_t flags = m_writer->m_config->m_metrics_flags; uint32_t flags = m_writer->m_config->m_metrics_flags;
// Note: ENGINE_FLAG_BPF_STATS_ENABLED check has been moved to libs, that is, when // Note: ENGINE_FLAG_BPF_STATS_ENABLED check has been moved to libs, that is, when
// libbpf stats is not enabled in the kernel settings we won't collect them even if the // libbpf stats is not enabled in the kernel settings we won't collect them even if the
@ -625,7 +629,7 @@ void stats_writer::collector::collect(const std::shared_ptr<sinsp>& inspector,
flags &= ~(METRICS_V2_KERNEL_COUNTERS | METRICS_V2_KERNEL_COUNTERS_PER_CPU | flags &= ~(METRICS_V2_KERNEL_COUNTERS | METRICS_V2_KERNEL_COUNTERS_PER_CPU |
METRICS_V2_STATE_COUNTERS | METRICS_V2_LIBBPF_STATS); METRICS_V2_STATE_COUNTERS | METRICS_V2_LIBBPF_STATS);
} }
m_writer->m_libs_metrics_collector = m_writer->m_libs_metrics_collectors[src] =
std::make_unique<libs::metrics::libs_metrics_collector>(inspector.get(), flags); std::make_unique<libs::metrics::libs_metrics_collector>(inspector.get(), flags);
} }
@ -658,7 +662,7 @@ void stats_writer::collector::collect(const std::shared_ptr<sinsp>& inspector,
now, now,
stats_snapshot_time_delta_sec); stats_snapshot_time_delta_sec);
get_metrics_output_fields_additional(output_fields, stats_snapshot_time_delta_sec); get_metrics_output_fields_additional(output_fields, stats_snapshot_time_delta_sec, src);
/* Send message in the queue */ /* Send message in the queue */
stats_writer::msg msg; stats_writer::msg msg;

7
userspace/falco/stats_writer.h
View File

@ -79,7 +79,8 @@ public:
fields. fields.
*/ */
void get_metrics_output_fields_additional(nlohmann::json& output_fields, void get_metrics_output_fields_additional(nlohmann::json& output_fields,
double stats_snapshot_time_delta_sec); double stats_snapshot_time_delta_sec,
const std::string& src);
std::shared_ptr<stats_writer> m_writer; std::shared_ptr<stats_writer> m_writer;
// Init m_last_tick w/ invalid value to enable metrics logging immediately after // Init m_last_tick w/ invalid value to enable metrics logging immediately after
@ -153,7 +154,9 @@ private:
tbb::concurrent_bounded_queue<stats_writer::msg> m_queue; tbb::concurrent_bounded_queue<stats_writer::msg> m_queue;
#endif #endif
#if defined(__linux__) and !defined(MINIMAL_BUILD) and !defined(__EMSCRIPTEN__) #if defined(__linux__) and !defined(MINIMAL_BUILD) and !defined(__EMSCRIPTEN__)
std::unique_ptr<libs::metrics::libs_metrics_collector> m_libs_metrics_collector; // Per source map of libs metrics collectors
std::unordered_map<std::string, std::unique_ptr<libs::metrics::libs_metrics_collector>>
m_libs_metrics_collectors;
std::unique_ptr<libs::metrics::output_rule_metrics_converter> m_output_rule_metrics_converter; std::unique_ptr<libs::metrics::output_rule_metrics_converter> m_output_rule_metrics_converter;
#endif #endif
std::shared_ptr<falco_outputs> m_outputs; std::shared_ptr<falco_outputs> m_outputs;