github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-28 10:51:24 +00:00
Code Issues Projects Releases Wiki Activity

fix(userspace/falco): move stats collection in event success path

Browse Source 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce 2022-09-01 12:59:09 +00:00 committed by poiana
parent d17e173e35
commit d11aec28d5
1 changed files with 25 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
userspace/falco/app_actions/process_events.cpp
View File

@ -97,31 +97,6 @@ application::run_result application::do_inspect(
{
rc = inspector->next(&ev);
// if we are in live mode, we already have the right source engine idx
if (is_capture_mode)
{
source_engine_idx = syscall_source_engine_idx;
if (ev->get_type() == PPME_PLUGINEVENT_E)
{
// note: here we can assume that the source index will be the same
// in both the falco engine and the sinsp plugin manager. See the
// comment in init_falco_engine.cpp for more details.
source_engine_idx = inspector->get_plugin_manager()->source_idx_by_plugin_id(*(int32_t *)ev->get_param(0)->m_val, source_engine_idx_found);
if (!source_engine_idx_found)
{
return run_result::fatal("Unknown plugin ID in inspector: " + std::to_string(*(int32_t *)ev->get_param(0)->m_val));
}
}
// for capture mode, the source name can change at every event
stats_collector.collect(inspector, source_names[source_engine_idx]);
}
else
{
// for live mode, the source name is constant
stats_collector.collect(inspector, source);
}
if(m_state->terminate.load(std::memory_order_acquire)
|| m_state->restart.load(std::memory_order_acquire))
{
@ -170,6 +145,31 @@ application::run_result application::do_inspect(
return run_result::fatal(inspector->getlasterr());
}
// if we are in live mode, we already have the right source engine idx
if (is_capture_mode)
{
source_engine_idx = syscall_source_engine_idx;
if (ev->get_type() == PPME_PLUGINEVENT_E)
{
// note: here we can assume that the source index will be the same
// in both the falco engine and the sinsp plugin manager. See the
// comment in init_falco_engine.cpp for more details.
source_engine_idx = inspector->get_plugin_manager()->source_idx_by_plugin_id(*(int32_t *)ev->get_param(0)->m_val, source_engine_idx_found);
if (!source_engine_idx_found)
{
return run_result::fatal("Unknown plugin ID in inspector: " + std::to_string(*(int32_t *)ev->get_param(0)->m_val));
}
}
// for capture mode, the source name can change at every event
stats_collector.collect(inspector, source_names[source_engine_idx]);
}
else
{
// for live mode, the source name is constant
stats_collector.collect(inspector, source);
}
// Reset the timeouts counter, Falco successfully got an event to process
timeouts_since_last_success_or_msg = 0;
if(duration_start == 0)