github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-01 06:37:22 +00:00
Code Issues Projects Releases Wiki Activity

cleanup(userspace): improve metrics UX

Browse Source 
add send_numeric_zero_values config to allow users to save space
when using metrics option, while still also allowing
to send all keys (especially because we don't document the schema)

Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
This commit is contained in:
Melissa Kilby
2023-05-29 13:49:17 +00:00
committed by poiana
parent 2e7a0b026f
commit e775fc6f5b
3 changed files with 32 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
userspace/falco/configuration.cpp
View File

@@ -68,7 +68,8 @@ falco_configuration::falco_configuration():
m_metrics_resource_utilization_enabled(true), m_metrics_resource_utilization_enabled(true),
m_metrics_kernel_event_counters_enabled(true), m_metrics_kernel_event_counters_enabled(true),
m_metrics_libbpf_stats_enabled(true), m_metrics_libbpf_stats_enabled(true),
m_metrics_convert_memory_to_mb(true) m_metrics_convert_memory_to_mb(true),
m_metrics_send_numeric_zero_values(false)
{ {
init({}); init({});
} }
@@ -356,6 +357,7 @@ void falco_configuration::load_yaml(const std::string& config_name, const yaml_h
m_metrics_kernel_event_counters_enabled = config.get_scalar<bool>("metrics.kernel_event_counters_enabled", true); m_metrics_kernel_event_counters_enabled = config.get_scalar<bool>("metrics.kernel_event_counters_enabled", true);
m_metrics_libbpf_stats_enabled = config.get_scalar<bool>("metrics.libbpf_stats_enabled", true); m_metrics_libbpf_stats_enabled = config.get_scalar<bool>("metrics.libbpf_stats_enabled", true);
m_metrics_convert_memory_to_mb = config.get_scalar<bool>("metrics.convert_memory_to_mb", true); m_metrics_convert_memory_to_mb = config.get_scalar<bool>("metrics.convert_memory_to_mb", true);
m_metrics_send_numeric_zero_values = config.get_scalar<bool>("metrics.send_numeric_zero_values", false);
std::vector<std::string> load_plugins; std::vector<std::string> load_plugins;

1
userspace/falco/configuration.h
View File

@@ -122,6 +122,7 @@ public:
bool m_metrics_kernel_event_counters_enabled; bool m_metrics_kernel_event_counters_enabled;
bool m_metrics_libbpf_stats_enabled; bool m_metrics_libbpf_stats_enabled;
bool m_metrics_convert_memory_to_mb; bool m_metrics_convert_memory_to_mb;
bool m_metrics_send_numeric_zero_values;
std::vector<plugin_config> m_plugins; std::vector<plugin_config> m_plugins;

37
userspace/falco/stats_writer.cpp
View File

@@ -254,8 +254,11 @@ void stats_writer::collector::get_metrics_output_fields_additional(
switch(utilization[stat].type) switch(utilization[stat].type)
{ {
case STATS_VALUE_TYPE_U64: case STATS_VALUE_TYPE_U64:
if (utilization[stat].value.u64 == 0 && !m_writer->m_config->m_metrics_send_numeric_zero_values)
if (m_writer->m_config->m_metrics_convert_memory_to_mb && strncmp(utilization[stat].name, "container_memory_used", 21) == 0) {
break;
}
if (m_writer->m_config->m_metrics_convert_memory_to_mb && strncmp(utilization[stat].name, "container_memory_used", 22) == 0) // exact str match
{ {
output_fields[metric_name] = (uint64_t)(utilization[stat].value.u64 / (double)1024 / (double)1024); output_fields[metric_name] = (uint64_t)(utilization[stat].value.u64 / (double)1024 / (double)1024);
} }
@@ -265,7 +268,11 @@ void stats_writer::collector::get_metrics_output_fields_additional(
} }
break; break;
case STATS_VALUE_TYPE_U32: case STATS_VALUE_TYPE_U32:
if (m_writer->m_config->m_metrics_convert_memory_to_mb && strncmp(utilization[stat].name, "memory_", 7) == 0) if (utilization[stat].value.u32 == 0 && !m_writer->m_config->m_metrics_send_numeric_zero_values)
{
break;
}
if (m_writer->m_config->m_metrics_convert_memory_to_mb && strncmp(utilization[stat].name, "memory_", 7) == 0) // prefix match
{ {
output_fields[metric_name] = (uint32_t)(utilization[stat].value.u32 / (double)1024); output_fields[metric_name] = (uint32_t)(utilization[stat].value.u32 / (double)1024);
} }
@@ -275,6 +282,10 @@ void stats_writer::collector::get_metrics_output_fields_additional(
} }
break; break;
case STATS_VALUE_TYPE_D: case STATS_VALUE_TYPE_D:
if (utilization[stat].value.d == 0 && !m_writer->m_config->m_metrics_send_numeric_zero_values)
{
break;
}
output_fields[metric_name] = utilization[stat].value.d; output_fields[metric_name] = utilization[stat].value.d;
break; break;
default: default:
@@ -317,9 +328,12 @@ void stats_writer::collector::get_metrics_output_fields_additional(
switch(stats_v2[stat].type) switch(stats_v2[stat].type)
{ {
case STATS_VALUE_TYPE_U64: case STATS_VALUE_TYPE_U64:
if (strncmp(stats_v2[stat].name, "n_evts", 6) == 0) /* Always send high level n_evts related fields, even if zero. */
if (strncmp(stats_v2[stat].name, "n_evts", 7) == 0) // exact not prefix match here
{ {
n_evts = stats_v2[stat].value.u64; n_evts = stats_v2[stat].value.u64;
output_fields[metric_name] = n_evts;
output_fields["scap.n_evts_prev"] = m_last_n_evts;
if (m_last_n_evts != 0 && stats_snapshot_time_delta_sec > 0) if (m_last_n_evts != 0 && stats_snapshot_time_delta_sec > 0)
{ {
/* n_evts is total number of kernel side events. */ /* n_evts is total number of kernel side events. */
@@ -329,11 +343,14 @@ void stats_writer::collector::get_metrics_output_fields_additional(
{ {
output_fields["scap.evts_rate_sec"] = (double)(0); output_fields["scap.evts_rate_sec"] = (double)(0);
} }
output_fields["scap.n_evts_prev"] = m_last_n_evts; m_last_n_evts = n_evts;
} }
else if (strncmp(stats_v2[stat].name, "n_drops", 7) == 0) /* Always send high level n_drops related fields, even if zero. */
else if (strncmp(stats_v2[stat].name, "n_drops", 8) == 0) // exact not prefix match here
{ {
n_drops = stats_v2[stat].value.u64; n_drops = stats_v2[stat].value.u64;
output_fields[metric_name] = n_drops;
output_fields["scap.n_drops_prev"] = m_last_n_drops;
if (m_last_n_drops != 0 && stats_snapshot_time_delta_sec > 0) if (m_last_n_drops != 0 && stats_snapshot_time_delta_sec > 0)
{ {
/* n_drops is total number of kernel side event drops. */ /* n_drops is total number of kernel side event drops. */
@@ -351,7 +368,11 @@ void stats_writer::collector::get_metrics_output_fields_additional(
{ {
output_fields["scap.n_drops_perc"] = (double)(0); output_fields["scap.n_drops_perc"] = (double)(0);
} }
output_fields["scap.n_drops_prev"] = m_last_n_drops; m_last_n_drops = n_drops;
}
if (stats_v2[stat].value.u64 == 0 && !m_writer->m_config->m_metrics_send_numeric_zero_values)
{
break;
} }
output_fields[metric_name] = stats_v2[stat].value.u64; output_fields[metric_name] = stats_v2[stat].value.u64;
break; break;
@@ -359,8 +380,6 @@ void stats_writer::collector::get_metrics_output_fields_additional(
break; break;
} }
} }
m_last_n_evts = n_evts;
m_last_n_drops = n_drops;
} }
#endif #endif
} }