mirror of
https://github.com/falcosecurity/falco.git
synced 2025-07-19 17:16:53 +00:00
update(userspace): add method to clear rule loader state
Once all rule files have been loaded, and all the rules have been compiled into filters and inserted in the engine rulesets, the loader definitions are maintained in memory without really being used. This commit adds a convenience method to clear the loader state and free-up some memory when engine consumers do not require such information in memory anymore. Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
parent
30fb58ed48
commit
e1a5427874
@ -444,6 +444,11 @@ void falco_engine::clear_filters()
|
||||
}
|
||||
}
|
||||
|
||||
void falco_engine::clear_loader()
|
||||
{
|
||||
m_rule_loader.clear();
|
||||
}
|
||||
|
||||
void falco_engine::set_sampling_ratio(uint32_t sampling_ratio)
|
||||
{
|
||||
m_sampling_ratio = sampling_ratio;
|
||||
|
@ -118,6 +118,15 @@ public:
|
||||
// Clear all existing filters.
|
||||
void clear_filters();
|
||||
|
||||
//
|
||||
// Clear all the definitions of the internal rule loader (e.g. defined
|
||||
// rules, macros, lists, engine/plugin version requirements). This is meant
|
||||
// to be used to free-up memory at runtime when the definitions are not
|
||||
// used anymore. Calling this between successive invocations of load_rules
|
||||
// or load_rules_file can cause failures of features like appending.
|
||||
//
|
||||
void clear_loader();
|
||||
|
||||
//
|
||||
// Set the sampling ratio, which can affect which events are
|
||||
// matched against the set of rules.
|
||||
|
@ -763,6 +763,9 @@ int falco_init(int argc, char **argv)
|
||||
}
|
||||
}
|
||||
|
||||
// Free-up memory for the rule loader, which is not used from now on
|
||||
engine->clear_loader();
|
||||
|
||||
for (auto substring : app.options().disabled_rule_substrings)
|
||||
{
|
||||
falco_logger::log(LOG_INFO, "Disabling rules matching substring: " + substring + "\n");
|
||||
|
Loading…
Reference in New Issue
Block a user