mirror of
https://github.com/falcosecurity/falco.git
synced 2025-08-31 06:10:45 +00:00
cleanup(userspace): improve metrics UX
add send_numeric_zero_values config to allow users to save space when using metrics option, while still also allowing to send all keys (especially because we don't document the schema) Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
This commit is contained in:
@@ -68,7 +68,8 @@ falco_configuration::falco_configuration():
|
||||
m_metrics_resource_utilization_enabled(true),
|
||||
m_metrics_kernel_event_counters_enabled(true),
|
||||
m_metrics_libbpf_stats_enabled(true),
|
||||
m_metrics_convert_memory_to_mb(true)
|
||||
m_metrics_convert_memory_to_mb(true),
|
||||
m_metrics_send_numeric_zero_values(false)
|
||||
{
|
||||
init({});
|
||||
}
|
||||
@@ -356,6 +357,7 @@ void falco_configuration::load_yaml(const std::string& config_name, const yaml_h
|
||||
m_metrics_kernel_event_counters_enabled = config.get_scalar<bool>("metrics.kernel_event_counters_enabled", true);
|
||||
m_metrics_libbpf_stats_enabled = config.get_scalar<bool>("metrics.libbpf_stats_enabled", true);
|
||||
m_metrics_convert_memory_to_mb = config.get_scalar<bool>("metrics.convert_memory_to_mb", true);
|
||||
m_metrics_send_numeric_zero_values = config.get_scalar<bool>("metrics.send_numeric_zero_values", false);
|
||||
|
||||
std::vector<std::string> load_plugins;
|
||||
|
||||
|
@@ -122,6 +122,7 @@ public:
|
||||
bool m_metrics_kernel_event_counters_enabled;
|
||||
bool m_metrics_libbpf_stats_enabled;
|
||||
bool m_metrics_convert_memory_to_mb;
|
||||
bool m_metrics_send_numeric_zero_values;
|
||||
|
||||
std::vector<plugin_config> m_plugins;
|
||||
|
||||
|
@@ -254,8 +254,11 @@ void stats_writer::collector::get_metrics_output_fields_additional(
|
||||
switch(utilization[stat].type)
|
||||
{
|
||||
case STATS_VALUE_TYPE_U64:
|
||||
|
||||
if (m_writer->m_config->m_metrics_convert_memory_to_mb && strncmp(utilization[stat].name, "container_memory_used", 21) == 0)
|
||||
if (utilization[stat].value.u64 == 0 && !m_writer->m_config->m_metrics_send_numeric_zero_values)
|
||||
{
|
||||
break;
|
||||
}
|
||||
if (m_writer->m_config->m_metrics_convert_memory_to_mb && strncmp(utilization[stat].name, "container_memory_used", 22) == 0) // exact str match
|
||||
{
|
||||
output_fields[metric_name] = (uint64_t)(utilization[stat].value.u64 / (double)1024 / (double)1024);
|
||||
}
|
||||
@@ -265,7 +268,11 @@ void stats_writer::collector::get_metrics_output_fields_additional(
|
||||
}
|
||||
break;
|
||||
case STATS_VALUE_TYPE_U32:
|
||||
if (m_writer->m_config->m_metrics_convert_memory_to_mb && strncmp(utilization[stat].name, "memory_", 7) == 0)
|
||||
if (utilization[stat].value.u32 == 0 && !m_writer->m_config->m_metrics_send_numeric_zero_values)
|
||||
{
|
||||
break;
|
||||
}
|
||||
if (m_writer->m_config->m_metrics_convert_memory_to_mb && strncmp(utilization[stat].name, "memory_", 7) == 0) // prefix match
|
||||
{
|
||||
output_fields[metric_name] = (uint32_t)(utilization[stat].value.u32 / (double)1024);
|
||||
}
|
||||
@@ -275,6 +282,10 @@ void stats_writer::collector::get_metrics_output_fields_additional(
|
||||
}
|
||||
break;
|
||||
case STATS_VALUE_TYPE_D:
|
||||
if (utilization[stat].value.d == 0 && !m_writer->m_config->m_metrics_send_numeric_zero_values)
|
||||
{
|
||||
break;
|
||||
}
|
||||
output_fields[metric_name] = utilization[stat].value.d;
|
||||
break;
|
||||
default:
|
||||
@@ -317,9 +328,12 @@ void stats_writer::collector::get_metrics_output_fields_additional(
|
||||
switch(stats_v2[stat].type)
|
||||
{
|
||||
case STATS_VALUE_TYPE_U64:
|
||||
if (strncmp(stats_v2[stat].name, "n_evts", 6) == 0)
|
||||
/* Always send high level n_evts related fields, even if zero. */
|
||||
if (strncmp(stats_v2[stat].name, "n_evts", 7) == 0) // exact not prefix match here
|
||||
{
|
||||
n_evts = stats_v2[stat].value.u64;
|
||||
output_fields[metric_name] = n_evts;
|
||||
output_fields["scap.n_evts_prev"] = m_last_n_evts;
|
||||
if (m_last_n_evts != 0 && stats_snapshot_time_delta_sec > 0)
|
||||
{
|
||||
/* n_evts is total number of kernel side events. */
|
||||
@@ -329,11 +343,14 @@ void stats_writer::collector::get_metrics_output_fields_additional(
|
||||
{
|
||||
output_fields["scap.evts_rate_sec"] = (double)(0);
|
||||
}
|
||||
output_fields["scap.n_evts_prev"] = m_last_n_evts;
|
||||
m_last_n_evts = n_evts;
|
||||
}
|
||||
else if (strncmp(stats_v2[stat].name, "n_drops", 7) == 0)
|
||||
/* Always send high level n_drops related fields, even if zero. */
|
||||
else if (strncmp(stats_v2[stat].name, "n_drops", 8) == 0) // exact not prefix match here
|
||||
{
|
||||
n_drops = stats_v2[stat].value.u64;
|
||||
output_fields[metric_name] = n_drops;
|
||||
output_fields["scap.n_drops_prev"] = m_last_n_drops;
|
||||
if (m_last_n_drops != 0 && stats_snapshot_time_delta_sec > 0)
|
||||
{
|
||||
/* n_drops is total number of kernel side event drops. */
|
||||
@@ -351,7 +368,11 @@ void stats_writer::collector::get_metrics_output_fields_additional(
|
||||
{
|
||||
output_fields["scap.n_drops_perc"] = (double)(0);
|
||||
}
|
||||
output_fields["scap.n_drops_prev"] = m_last_n_drops;
|
||||
m_last_n_drops = n_drops;
|
||||
}
|
||||
if (stats_v2[stat].value.u64 == 0 && !m_writer->m_config->m_metrics_send_numeric_zero_values)
|
||||
{
|
||||
break;
|
||||
}
|
||||
output_fields[metric_name] = stats_v2[stat].value.u64;
|
||||
break;
|
||||
@@ -359,8 +380,6 @@ void stats_writer::collector::get_metrics_output_fields_additional(
|
||||
break;
|
||||
}
|
||||
}
|
||||
m_last_n_evts = n_evts;
|
||||
m_last_n_drops = n_drops;
|
||||
}
|
||||
#endif
|
||||
}
|
||||
|
Reference in New Issue
Block a user