Mark Stemm 2d5fc0b647 Use the same falco_rule struct for every call to filter_ruleset ...

Instead of using a falco_rule struct on the stack, use a single value
inside the falco_source struct. It's mutable as find_source returns a
const struct.

At very high event volumes (> 1M syscalls/second), even the tiny time
it takes to create/destroy the struct starts to add up, and this
switch has some small cpu savings.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>

2022-09-16 12:50:39 +02:00

..

banned.h

feat(userspace): Add BAN_ALTERNATIVE macro to banned.h.

2020-02-13 18:01:39 +01:00

CMakeLists.txt

Add a load result interface for use in new load_rules methods

2022-08-04 14:49:23 +02:00

evttype_index_ruleset.cpp

refactor(userspace/engine): improve ruleset interface definitions

2022-05-25 09:16:45 +02:00

evttype_index_ruleset.h

update(userspace/engine): rename ruleset.h in filter_ruleset.h

2022-05-25 09:16:45 +02:00

falco_common.cpp

refactor(userspace/engine): polish falco_common and improve priority parsing/formatting

2022-04-11 22:21:20 +02:00

falco_common.h

refactor(userspace/engine): polish falco_common and improve priority parsing/formatting

2022-04-11 22:21:20 +02:00

falco_engine_version.h

update(usperspace/engine): bump engine version to 15

2022-09-05 14:40:31 +02:00

falco_engine.cpp

Use the same falco_rule struct for every call to filter_ruleset

2022-09-16 12:50:39 +02:00

falco_engine.h

Save syscall source separately and check explicitly in process_event

2022-09-16 12:50:39 +02:00

falco_load_result.cpp

Add a load result interface for use in new load_rules methods

2022-08-04 14:49:23 +02:00

falco_load_result.h

Restructure rules result to properly support multiple files

2022-08-19 11:55:43 +02:00

falco_rule.h

refactor(userspace/engine): refactor engine interface and internals

2022-05-25 09:16:45 +02:00

falco_source.h

Use the same falco_rule struct for every call to filter_ruleset

2022-09-16 12:50:39 +02:00

falco_utils.cpp

update(userspace/engine): minor improvements and bug fixes on engine and rule loader

2022-04-11 12:22:18 +02:00

falco_utils.h

update(userspace/engine): minor improvements and bug fixes on engine and rule loader

2022-04-11 12:22:18 +02:00

filter_evttype_resolver.cpp

remove sinsp.h public dependencies

2022-09-05 17:42:31 +02:00

filter_evttype_resolver.h

fix(userspace/engine): properly include stdexcept header to fix build.

2022-09-12 12:28:15 +02:00

filter_macro_resolver.cpp

Improve Falco engine performance when loading rules and creating the rule sets

2022-09-05 17:42:31 +02:00

filter_macro_resolver.h

Improve Falco engine performance when loading rules and creating the rule sets

2022-09-05 17:42:31 +02:00

filter_ruleset.h

update(userspace/engine): rename ruleset.h in filter_ruleset.h

2022-05-25 09:16:45 +02:00

filter_warning_resolver.cpp

Change filter_warning_resolver to use warning codes

2022-08-04 14:49:23 +02:00

filter_warning_resolver.h

Change filter_warning_resolver to use warning codes

2022-08-04 14:49:23 +02:00

formats.cpp

refactor(userspace/engine): increase const coherence of falco engine

2022-08-26 11:04:18 +02:00

formats.h

refactor(userspace/engine): increase const coherence of falco engine

2022-08-26 11:04:18 +02:00

indexed_vector.h

Improve Falco engine performance when loading rules and creating the rule sets

2022-09-05 17:42:31 +02:00

json_evt.cpp

Improve Falco engine performance when loading rules and creating the rule sets

2022-09-05 17:42:31 +02:00

json_evt.h

Improve Falco engine performance when loading rules and creating the rule sets

2022-09-05 17:42:31 +02:00

OWNERS

docs: specify labels that apply to each area

2019-09-16 10:11:25 +02:00

rule_loader.cpp

Use enums for rules content item type

2022-09-07 10:13:02 +02:00

rule_loader.h

Use enums for rules content item type

2022-09-07 10:13:02 +02:00

rule_reader.cpp

fix(userspace/engine): avoid reading duplicate exception values

2022-09-12 15:53:15 +02:00

rule_reader.h

refactor(userspace/engine): apply C++ best practices to newest engine classes

2022-04-27 16:22:59 +02:00

stats_manager.cpp

chore(userspace/engine): fix typos

2022-08-26 11:26:18 +02:00

stats_manager.h

refactor(userspace/engine): make stats manager thread-safe for on_event method

2022-08-26 11:26:18 +02:00