mirror of
https://github.com/falcosecurity/falco.git
synced 2026-05-12 17:52:56 +00:00
104c99c42e
Add token-bucket based rate limiting for falco notifications. The token bucket is implemented in token_bucket.cpp (actually in the engine directory, just to make it easier to include in other programs). It maintains a current count of tokens (i.e. right to send a notification). Its main method is claim(), which attemps to claim a token and returns true if one was claimed successfully. It has a configurable configurable max burst size and rate. The token bucket gains "rate" tokens per second, up to a maximum of max_burst tokens. These parameters are configurable in falco.yaml via the config options (defaults shown): outputs: rate: 1 max_burst: 1000 In falco_outputs::handle_event(), try to claim a token, and if unsuccessful log a debug message and return immediately.
32 lines
1.0 KiB
CMake
32 lines
1.0 KiB
CMake
include_directories("${PROJECT_SOURCE_DIR}/../sysdig/userspace/libsinsp/third-party/jsoncpp")
|
|
include_directories("${PROJECT_SOURCE_DIR}/../sysdig/userspace/libscap")
|
|
include_directories("${PROJECT_SOURCE_DIR}/../sysdig/userspace/libsinsp")
|
|
include_directories("${PROJECT_BINARY_DIR}/userspace/engine")
|
|
include_directories("${LUAJIT_INCLUDE}")
|
|
|
|
add_library(falco_engine STATIC rules.cpp falco_common.cpp falco_engine.cpp token_bucket.cpp formats.cpp)
|
|
|
|
target_include_directories(falco_engine PUBLIC
|
|
"${LUAJIT_INCLUDE}")
|
|
|
|
target_link_libraries(falco_engine
|
|
"${FALCO_SINSP_LIBRARY}"
|
|
"${LPEG_LIB}"
|
|
"${LYAML_LIB}"
|
|
"${LIBYAML_LIB}")
|
|
|
|
configure_file(config_falco_engine.h.in config_falco_engine.h)
|
|
|
|
if(DEFINED FALCO_COMPONENT)
|
|
install(DIRECTORY lua
|
|
DESTINATION "${FALCO_SHARE_DIR}"
|
|
COMPONENT "${FALCO_COMPONENT}"
|
|
FILES_MATCHING PATTERN *.lua)
|
|
else()
|
|
install(DIRECTORY lua
|
|
DESTINATION "${FALCO_SHARE_DIR}"
|
|
FILES_MATCHING PATTERN *.lua)
|
|
endif()
|
|
|
|
add_subdirectory("${PROJECT_SOURCE_DIR}/../falco/rules" "${PROJECT_BINARY_DIR}/rules")
|