From df8e4e0545d4a4de75b85fd2b6153f9479b62c8b Mon Sep 17 00:00:00 2001 From: Leonardo Grasso Date: Fri, 6 Nov 2020 17:26:31 +0100 Subject: [PATCH] new: Falco config for output timeout Signed-off-by: Leonardo Grasso --- falco.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/falco.yaml b/falco.yaml index 969b9d5c..618aeca3 100644 --- a/falco.yaml +++ b/falco.yaml @@ -87,6 +87,21 @@ syscall_event_drops: rate: .03333 max_burst: 10 + +# Falco continuously monitors outputs performance. When an output channel does not allow +# to deliver an alert within a given deadline, an error is reported to the log indicating +# which output is blocking notifications. +# An output timeout error may indicate a misconfiguration issue or I/O problems +# that should be fixed by the user. +# +# The "output_timeout" value specifies the duration in milliseconds to wait before +# considering the deadline exceed. +# +# With a 2000ms default, the notification consumer can block the Falco output +# for up to 2 seconds without reaching the timeout. + +output_timeout: 2000 + # A throttling mechanism implemented as a token bucket limits the # rate of falco notifications. This throttling is controlled by the following configuration # options: