github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2026-03-18 18:58:41 +00:00
Code Issues Projects Releases Wiki Activity

fix(userspace/falco): correct default duration calculation

Browse Source 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
This commit is contained in:
Leonardo Grasso
2025-10-21 18:54:42 +02:00
committed by poiana
parent 0d00bcc210
commit d8e430e352
1 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
userspace/falco/app/actions/process_events.cpp
View File

@@ -320,9 +320,16 @@ static falco::app::run_result do_inspect(
if(capture_mode_t::RULES == s.config->m_capture_mode && rule_res.capture) {
capture = true;
}
// Extend deadline if defined by the rule
if((rule_res.capture_duration_ns + ev->get_ts()) > dump_deadline_ts) {
dump_deadline_ts = ev->get_ts() + rule_res.capture_duration_ns;
// Compute the capture deadline for this event,
// based on the rule’s duration or the default one if unspecified
auto evt_deadline_ts =
ev->get_ts() + (rule_res.capture_duration_ns > 0
? rule_res.capture_duration_ns
: s.config->m_capture_default_duration_ns);
// Update the capture deadline if this event needs to extend it beyond the
// current deadline or if no deadline is currently set
if(evt_deadline_ts > dump_deadline_ts) {
dump_deadline_ts = evt_deadline_ts;
}
}
}
@@ -336,10 +343,6 @@ static falco::app::run_result do_inspect(
ev->get_num()),
true); // Enable compression
dump_started_ts = ev->get_ts();
// If no rule has set a deadline, use the default one
if(dump_deadline_ts == 0) {
dump_deadline_ts = dump_started_ts + s.config->m_capture_default_duration_ns;
}
}
}