From d11aec28d56402242fc5994c4eec164b5e93a221 Mon Sep 17 00:00:00 2001 From: Jason Dellaluce Date: Thu, 1 Sep 2022 12:59:09 +0000 Subject: [PATCH] fix(userspace/falco): move stats collection in event success path Signed-off-by: Jason Dellaluce --- .../falco/app_actions/process_events.cpp | 50 +++++++++---------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/userspace/falco/app_actions/process_events.cpp b/userspace/falco/app_actions/process_events.cpp index 080df4a8..8efe12fb 100644 --- a/userspace/falco/app_actions/process_events.cpp +++ b/userspace/falco/app_actions/process_events.cpp @@ -97,31 +97,6 @@ application::run_result application::do_inspect( { rc = inspector->next(&ev); - // if we are in live mode, we already have the right source engine idx - if (is_capture_mode) - { - source_engine_idx = syscall_source_engine_idx; - if (ev->get_type() == PPME_PLUGINEVENT_E) - { - // note: here we can assume that the source index will be the same - // in both the falco engine and the sinsp plugin manager. See the - // comment in init_falco_engine.cpp for more details. - source_engine_idx = inspector->get_plugin_manager()->source_idx_by_plugin_id(*(int32_t *)ev->get_param(0)->m_val, source_engine_idx_found); - if (!source_engine_idx_found) - { - return run_result::fatal("Unknown plugin ID in inspector: " + std::to_string(*(int32_t *)ev->get_param(0)->m_val)); - } - } - - // for capture mode, the source name can change at every event - stats_collector.collect(inspector, source_names[source_engine_idx]); - } - else - { - // for live mode, the source name is constant - stats_collector.collect(inspector, source); - } - if(m_state->terminate.load(std::memory_order_acquire) || m_state->restart.load(std::memory_order_acquire)) { @@ -170,6 +145,31 @@ application::run_result application::do_inspect( return run_result::fatal(inspector->getlasterr()); } + // if we are in live mode, we already have the right source engine idx + if (is_capture_mode) + { + source_engine_idx = syscall_source_engine_idx; + if (ev->get_type() == PPME_PLUGINEVENT_E) + { + // note: here we can assume that the source index will be the same + // in both the falco engine and the sinsp plugin manager. See the + // comment in init_falco_engine.cpp for more details. + source_engine_idx = inspector->get_plugin_manager()->source_idx_by_plugin_id(*(int32_t *)ev->get_param(0)->m_val, source_engine_idx_found); + if (!source_engine_idx_found) + { + return run_result::fatal("Unknown plugin ID in inspector: " + std::to_string(*(int32_t *)ev->get_param(0)->m_val)); + } + } + + // for capture mode, the source name can change at every event + stats_collector.collect(inspector, source_names[source_engine_idx]); + } + else + { + // for live mode, the source name is constant + stats_collector.collect(inspector, source); + } + // Reset the timeouts counter, Falco successfully got an event to process timeouts_since_last_success_or_msg = 0; if(duration_start == 0)