Add ability to filter events by priority/cleanups

Clean up the handling of priority levels within rules. It used to be a
mix of strings handled in various places. Now, in falco_common.h there's
a consistent type for priority-as-number as well as a list of
priority-as-string values. Priorities are passed around as numbers
instead of strings. It's still permissive about capitalization.

Also add the ability to load rules by severity. New falco
config option "priority=<val>"/-o priority=<val> specifies the minimum
priority level of rules that will be loaded.

Add unit tests for same. The test suppresses INFO notifications for a
rule/trace file combination that would otherwise generate them.
This commit is contained in:
Mark Stemm
2017-10-05 17:20:54 -07:00
parent c41bcbd240
commit aa073586f1
16 changed files with 132 additions and 51 deletions

View File

@@ -21,6 +21,16 @@ along with falco. If not, see <http://www.gnu.org/licenses/>.
#include "config_falco_engine.h"
#include "falco_common.h"
std::vector<std::string> falco_common::priority_names = {
"Emergency",
"Alert",
"Critical",
"Error",
"Warning",
"Notice",
"Informational",
"Debug"};
falco_common::falco_common()
{
m_ls = lua_open();