Leonardo Di Donato c1da6d21b9 new: syscall_event_timeouts configuration block ...

Falco uses a shared buffer between the kernel and userspace to receive
the events (eg., system call information) in userspace.
Anyways, the underlying libraries can also timeout for various reasons.
For example, there could have been issues while reading an event.
Or the particular event needs to be skipped.
Normally, it's very unlikely that Falco does not receive events consecutively.
Falco is able to detect such uncommon situation.
Here you can configure the maximum number of consecutive timeouts without an event
after which you want Falco to alert.
By default this value is set to 1000 consecutive timeouts without an event at all.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>

2021-04-19 16:56:53 +02:00

..

engine

new(userspace/engine): likely/unlikely macros in utils

2021-04-19 16:56:53 +02:00

falco

new: syscall_event_timeouts configuration block

2021-04-19 16:56:53 +02:00