diff --git a/falco.yaml b/falco.yaml index 969b9d5c..618aeca3 100644 --- a/falco.yaml +++ b/falco.yaml @@ -87,6 +87,21 @@ syscall_event_drops: rate: .03333 max_burst: 10 + +# Falco continuously monitors outputs performance. When an output channel does not allow +# to deliver an alert within a given deadline, an error is reported to the log indicating +# which output is blocking notifications. +# An output timeout error may indicate a misconfiguration issue or I/O problems +# that should be fixed by the user. +# +# The "output_timeout" value specifies the duration in milliseconds to wait before +# considering the deadline exceed. +# +# With a 2000ms default, the notification consumer can block the Falco output +# for up to 2 seconds without reaching the timeout. + +output_timeout: 2000 + # A throttling mechanism implemented as a token bucket limits the # rate of falco notifications. This throttling is controlled by the following configuration # options: