Melissa Kilby
6057c1553e
cleanup(engine): print total number of enabled rules
...
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-05-16 10:29:53 +02:00
Melissa Kilby
77341cbd2e
new(engine): add print_enabled_rules_falco_logger when log_level debug
...
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-05-16 10:29:53 +02:00
Luca Guerra
eb3ee5d2b2
update(falco): add deprecation warning messages
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-05-15 10:33:50 +02:00
Luca Guerra
f9a56d9c9d
update(falco): add deprecation notice for -T, -t and -D
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-05-15 10:33:50 +02:00
Luca Guerra
abf82f6373
update(config): split init_from_content from init_from_file
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-05-14 12:47:46 +02:00
Luca Guerra
35bd348e21
new(falco): implement rule selection configuration in falco.yaml
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-05-14 12:47:46 +02:00
Melissa Kilby
60e6798f9b
cleanup(metrics): use map for config and rules filenames sha256 tracking
...
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-05-14 10:08:51 +02:00
Melissa Kilby
91b58c43f1
chore: fix non linux build metrics
...
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-05-14 10:08:51 +02:00
Melissa Kilby
67a5015be7
cleanup(metrics): use filesystem lib to derive file names + build fix
...
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-05-14 10:08:51 +02:00
Melissa Kilby
34ecd39113
new(metrics): add file sha256sum metrics for loaded config and rules files
...
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-05-14 10:08:51 +02:00
Melissa Kilby
2b80cf85ac
new(utils): add new helper to calculate file sha256sum
...
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-05-14 10:08:51 +02:00
Federico Di Pierro
dd9163c6f4
fix(userspace/falco): fix state inizialization.
...
This fixes an ugly segfault happening during hot reload.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-05-09 10:43:58 +02:00
Jason Dellaluce
b2e4cddcdf
fix(userspace/falco): inizialize options variables
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-05-08 20:23:55 +02:00
Jason Dellaluce
f18ea1e8b7
update(userspace/engine): support tranformers in exception fields
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-05-08 20:23:55 +02:00
Jason Dellaluce
fa8e780b07
update(userspace/engine): propagate compiler warnings
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-05-08 20:23:55 +02:00
Jason Dellaluce
bc078f1f63
update(userspace/engine): support comparins with right-hand fields
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-05-08 20:23:55 +02:00
Jason Dellaluce
ed22e94292
refactor(userspace/libsinsp): support new filter ast structure in falco engine
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-05-08 20:23:55 +02:00
Federico Aponte
62d1c4fc4d
refactor: smart pointer usage
...
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-05-06 11:10:44 +02:00
Federico Di Pierro
6954a4028e
chore(userspace/engine): bump version and checksum.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-05-03 12:12:02 +02:00
Samuel Gaist
cbfe77d1a0
fix(falco_metrics): remove falco_ prefix for version
...
The textual content was fixed but not the metrics name.
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
66d1970952
fix(falco_metrics): make duration_sec and outputs_queue_num_drops monotonic
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
82c914c11d
fix(falco_metrics): make duration_sec a count and not a timestamp
...
The output will thus be a total which is what this metrics is.
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
2ae6103ab6
fix(falco_metrics): remove redundant falco in version metrics
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
65331c0f20
feat(falco_metrics): add event sources
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
1ba35c911a
feat(falco_metrics): add duration_sec
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
5ef8f1c311
feat(falco_metrics): add outputs_queue_num_drops
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
f90dbf9b77
refactor(metrics): use prometheus_metrics_enabled for configuration
...
As agreed upon during review, use this name to get started. If more
backends were to be added, the configuration structure will be updated.
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
5c237a07dc
refactor(metrics): make to_text get the application state
...
As falco may update its state at any time and thus its inspectors objects,
keeping pointers to them may end up in using dangling values.
Therefore, use the state of the application when requesting metrics.
Optimizations such as caching of mostly static values will be done in
a follow up patch.
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
a0c109fcff
refactor(falco_metrics): put content type in documented constant
...
This will keep things clearer and also allow for easir update in
the future.
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
9cc44c0eb7
doc(falco_metrics): add basic documentation
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
de7a70ea54
fix(metrics): correct hostname metrics name and namespace
...
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
53722a26bf
fix(metrics): correct static metrics
...
Things to fix:
- type
- name
- unit
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
59c290dc80
fix(metrics): correct metrics namespace
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
daf7efde67
refactor(metrics): move metrics handling to its own class
...
This will keep the details out of the webserver itself and make
it easier to manage metrics.
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
e50d647dc9
refactor(configuration): move webserver items in own struct
...
This makes things easier to pass around like when starting the
web server.
This has the added benefit of simplifying further extension such as
making the metrics endpoint name configurable without adding yet another
parameter to the start function.
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
968a403cba
refactor(webserver): move metrics endpoint activation under webserver
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
cd073a033a
fix(webserver): use falcosecurity as metric namespace
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
4819877b9f
fix(webserver): remove extra line return
...
The converter already provides properly formatted text.
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
3a251beea7
fix(webserver): correct enabled check
...
It was checking twice for prometheus configuration rather than metrics and then prometheus.
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
8f1b2dc909
feat(webserver): implement metrics endpoint
...
This endpoint currently returns only prometheus metrics.
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Luca Guerra
814c510d7e
update(app): close inspectors at teardown time
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-04-17 18:39:54 +02:00
Gianmatteo Palmieri
eb04b1c66f
fix(test): expect warning instead of error on invalid macro/list name
...
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-04-17 11:27:52 +02:00
Gianmatteo Palmieri
dd59c48034
new(engine): raise warning instead of error on invalid macro/list name
...
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-04-17 11:27:52 +02:00
Federico Di Pierro
e21a3a5e58
chore(userspace/falco): make it clear singular vs plural.
...
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-16 16:39:47 +02:00
Federico Di Pierro
a2a8c6c3d4
chore(userspace/falco): deprecate old 'rules_file' config key.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-16 16:39:47 +02:00
Gianmatteo Palmieri
83910be726
new(engine): raise warning instead of error on not-unique exceptions names
...
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-04-11 17:22:28 +02:00
Federico Di Pierro
8b340d3903
chore(userspace/falco): watch all configs files.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 15:57:20 +02:00
Federico Di Pierro
e840a4ada0
new(unit_tests,userspace/falco): support loading and merging configs files when used from cmdline option.
...
Also, moved core logic from yaml_helper to falco_configuration class.
Finally, updated tests.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
a8345327d4
chore(unit_tests,userspace/falco): throw an exception when included config file is not present.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
de9efcbec7
new(userspace/falco): allow --support
to print expanded configuration file.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
74034213a2
chore(unit_test,userspace): better log management.
...
Also, warnings are now returned so that yaml_helper class does not need to log anything.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
aac9b550d3
new(userspace,unit_tests): return loaded config filenames in config::load_from_file.
...
Add a debug log with the list of loaded config files.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
df220e3c3b
chore(userspace,unit_tests): support loading config files from directories.
...
The files inside the folder will be loaded in lexicographic order,
like we do for rules_file.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
d3bf3a7560
chore(userspace/falco,unit_tests): renamed includes
to configs_files
.
...
Moreover, split single huge test into multiple smaller ones.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
1deafee5f7
chore(userspace/falco): print a warn message if -o includes=
is passed to cmdline.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
45754fda9f
new(userspace,unit_tests): deny main config to include itself.
...
Moreover, added a couple more tests.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
8112f6210b
chore(userspace,unit_tests): enable override of main config from secondary config files.
...
Moreover, do not trigger an exception when an included file is not present; just print a warning.
Finally, add more tests.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
b3ebf9f57e
new(userspace,unit_tests): introduce the possibility to split main config file into multiple config files.
...
The PR introduces a `includes` keyword in the config file,
that points to a list of strings (paths to other config files).
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Gianmatteo Palmieri
7234bc5bee
chore(engine): bump engine version
...
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-04-03 18:23:53 +02:00
Gianmatteo Palmieri
05c434ed89
new(engine): enforce unique exceptions names
...
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-04-03 18:23:53 +02:00
Luca Guerra
1aae10fe84
update(engine): bump engine checksum and version
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-03-29 10:16:23 +01:00
Luca Guerra
13c8e37a41
cleanup(falco): consolidate falco::grpc::server in one class
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-03-28 10:16:15 +01:00
Gianmatteo Palmieri
7086f35eba
new(engine): add warning when appending an exception with no values
...
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-03-27 09:15:13 +01:00
Gianmatteo Palmieri
d1707bef63
fix(engine): apply output substitutions for all sources
...
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-03-25 19:33:06 +01:00
Melissa Kilby
3b7b3439ec
cleanup(metrics): fix build for non linux
...
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-03-14 10:55:24 +01:00
Melissa Kilby
09d813b22d
feat(metrics): sync libs metrics collector refactor
...
Includes a handful of naming changes. A notice to
https://falco.org/docs/metrics/falco-metrics/ will be added well
in advance of Falco 0.38.0
falco.hostname -> evt.hostname to be consistent with the newer evt.hostname filtercheck
cpu_usage_perc_total_host -> host_cpu_usage_perc
memory_used_host -> host_memory_used_kb (or host_memory_used_mb)
procs_running_host -> host_procs_running
open_fds_host -> host_open_fds
memory_rss -> memory_rss_kb (or memory_rss_mb)
memory_pss -> memory_pss_kb (or memory_pss_mb)
memory_vsz -> memory_vsz_kb (or memory_vsz_mb)
container_memory_used -> container_memory_used_bytes (or container_memory_used_mb)
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-03-14 10:55:24 +01:00
Andrea Terzolo
0ce2b95b89
chore: bump falco engine version
...
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-03-12 16:29:17 +01:00
Federico Aponte
8dbec6c779
refactor: Use FetchContent for integrating bundled yaml-cpp lib
...
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-03-11 13:57:15 +01:00
Federico Aponte
c32b7c1246
refactor: Use FetchContent for integrating bundled cpp-httplib
...
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-03-11 13:57:15 +01:00
Federico Aponte
bc499e191d
refactor: Use FetchContent for integrating bundled nlohman-json lib
...
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-03-11 13:57:15 +01:00
Gianmatteo Palmieri
517b79ee13
chore(engine): bump engine version
...
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-03-08 00:02:01 +01:00
Gianmatteo Palmieri
7265190e66
new(engine): don't expose details in error message
...
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-03-08 00:02:01 +01:00
Gianmatteo Palmieri
f00926b8af
new(engine): error on invalid macro/list name
...
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-03-08 00:02:01 +01:00
Melissa Kilby
5185f152c5
new(config): add falco_libs.thread_table_size
...
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-03-05 11:36:51 +01:00
Samuel Gaist
8f87b117c4
fix(userspace): correct directory iteration options
...
The original code was using follow_directory_symlink twice, this patch
fixes that.
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-03-05 10:29:51 +01:00
Samuel Gaist
f9b17b67f8
refactor(engine): fix variable / function shadowing
...
Improve variable names in the code surrounding the changes.
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-29 16:20:34 +01:00
Samuel Gaist
8a7361c8ab
refactor(app): fix variable / function shadowing
...
Improve variable names in the code surrounding the changes.
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-29 16:20:34 +01:00
Gianmatteo Palmieri
ea781477d6
fix(engine): logical issue in exceptions condition
...
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-02-28 08:28:26 +01:00
Federico Aponte
f6af72fe76
cleanup: too many includes and useless defines
...
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-26 14:59:22 +01:00
Federico Aponte
4d66a50d5b
fix: pessimizing move warning
...
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-26 14:59:22 +01:00
Federico Aponte
59c14f46a2
refactor: shared_ptr construction
...
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-26 14:59:22 +01:00
Federico Aponte
557929a82a
refactor: use object rather than unique_ptr
...
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-26 14:59:22 +01:00
Federico Aponte
9a2b58c6f7
refactor: very minor improvement
...
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-26 14:59:22 +01:00
Gianmatteo Palmieri
91e74b1b19
cleanup(build): remove bundled dep check
...
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-02-23 15:43:08 +01:00
Jason Dellaluce
3b06fb2cbb
fix(userspace): solve compilation issues
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-02-23 11:39:07 +01:00
Jason Dellaluce
c13cf79aab
update(engine): bump engine version
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-02-23 11:39:07 +01:00
Jason Dellaluce
0ec2a6c708
refactor(userspace): reduce usage of raw pointers
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-02-23 11:39:07 +01:00
Jason Dellaluce
b515f0a079
refactor(usersapace): adapt to changes libs
...
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-02-23 11:39:07 +01:00
Federico Aponte
745d18ba38
refactor: test AtomicSignalHandler.handle_once_wait_consistency
...
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-20 15:19:56 +01:00
Samuel Gaist
05e796723f
fix(userspace): remove unread variable in restart_handler
...
When hitting that part, the restart signal is triggered and the code
leaves the loop, hence setting should_restart as false makes no sense
in this context.
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-19 18:01:48 +01:00
Samuel Gaist
ad585cd46b
fix(actions): remove unused variable in print_support
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-19 18:01:48 +01:00
Andrea Terzolo
a44bee57d9
fix(CI): fix windows CI
...
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-02-16 18:30:38 +01:00
Andrea Terzolo
d49b21ab22
cleanup: move ebpf default value logic
...
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-02-16 18:30:38 +01:00
Andrea Terzolo
99781f7936
cleanup(configuration): cleanup deprecated code
...
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-02-16 18:30:38 +01:00
Samuel Gaist
5e497a4119
fix(c++): improve const correctness
...
Reported by cppcheck
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-15 22:16:33 +01:00
Luca Guerra
5564d3da11
cleanup(app): ensure unbuffered_outputs is initialized
...
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-15 11:03:30 +01:00
Samuel Gaist
e18acc361e
fix(c++): don't throw outside of the try catch block in nothrow function
...
Reported by cppcheck
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-15 10:19:30 +01:00
Samuel Gaist
f3491d62c9
fix(c++): re-throw original exception rather than copy
...
Reported by cppcheck
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-15 10:19:30 +01:00
Federico Aponte
7a18795ca5
cleanup: falco_engine deps and include paths
...
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-15 10:08:30 +01:00
Samuel Gaist
8c98ca5e8d
fix(c++): add missing member initialisation to grpc server
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-12 18:45:18 +01:00