7fb9986e5a
fix(prometheus): deprecate enter events drop stats
...
Enter events are no longer tracked by the Falco libs, this change
deprecates the Prometheus metrics related to enter event drops.
Signed-off-by: Iacopo Rozzo <iacopo@sysdig.com>
2025-09-23 10:37:08 +02:00
4fa53452c3
fix(userspace/engine): fix logger date format
...
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2025-09-18 14:54:46 +02:00
4d3b685c8b
feat: make libs internal auto thread purging intervals configurable
...
Make Falco's libs internal auto thread purging interval and timeout
configurable and set their default values to 5 minutes. This helps
controlling the memory impact of process exit events dropping and
events re-ordering.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2025-09-16 15:42:34 +02:00
7c7196f1f0
chore: pre-commit cleanup
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2025-09-16 09:38:29 +02:00
e34caee3f8
Revert "refactor(userspace/falco): remove duplicate condition test"
...
This reverts commit 0ae61528fb
2025-09-16 09:38:29 +02:00
909122a849
refactor(userspace/falco): remove duplicate condition test
...
handled is test a second time for the same while it's already
part of the initial entry condition.
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2025-09-16 09:38:29 +02:00
e8c527f204
refactor(userspace/falco): comment out unused variable names
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2025-09-16 09:38:29 +02:00
179234e08e
refactor(userspace/falco): add missing override
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2025-09-16 09:38:29 +02:00
d6fde4ac16
refactore(userspace/falco): use static_cast rather than c style cast
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2025-09-16 09:38:29 +02:00
cdea5ad35f
refactor(userspace/falco): correct variable scope
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2025-09-16 09:38:29 +02:00
07438534e7
refactor(userspace/falco): add missing initial value
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2025-09-16 09:38:29 +02:00
dadf81ed9d
fix(userspace/falco): use correct qualifier for size_t in printf
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2025-09-16 09:38:29 +02:00
3b91cb685f
refactor(userspace/falco): const correctness
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2025-09-16 09:38:29 +02:00
e5654849d4
refactor(userspace/engine): port from asctime to strftime
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2025-09-16 09:38:29 +02:00
0cc39ac5e7
refactor(userspace/engine): make constructor explicit
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2025-09-16 09:38:29 +02:00
d9f561cd7b
refactor(userspace/engine): remove unused variable
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2025-09-16 09:38:29 +02:00
668bbfc9de
refactor(userpsace/engine): add missing override
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2025-09-16 09:38:29 +02:00
4d03686999
refactor(userspace/engine): fix variable scope
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2025-09-16 09:38:29 +02:00
2da40e798b
refactor(userspace/engine): const correctness
...
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2025-09-16 09:38:29 +02:00
fda1430afb
fix(userspace/falco): smart pointer for sinsp_dumper
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2025-08-12 11:25:43 +02:00
97d88d12f1
chore(userspace/engine): initialize bool member for falco_rule
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2025-08-12 11:25:43 +02:00
3af03998eb
fix(userspace/falco): correct typo in type
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2025-08-12 11:25:43 +02:00
aa501437a4
fix(userspace/engine): adding capture members to to the rule equility operator
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2025-08-12 11:25:43 +02:00
504d52e694
fix(userspace/falco): address init ordering warning for `falco_configuration`
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2025-08-12 11:25:43 +02:00
8dbd04816d
fix(userspace/falco): add "capture" in config schema
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2025-08-12 11:25:43 +02:00
63d27fbe1b
chore: fix formatting
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2025-08-12 11:25:43 +02:00
81f26b7e5d
chore(userspace/falco): fix codespell
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2025-08-12 11:25:43 +02:00
15e8a746cb
new(userspace/falco): capture feature impl
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2025-08-12 11:25:43 +02:00
a818d48806
new(userspace/falco): add file name generator helper for capture
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2025-08-12 11:25:43 +02:00
1da5514012
new(userspapace/engine): add `capture` and `capture_duration` to the engine
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2025-08-12 11:25:43 +02:00
21350a282c
new(userspapace/engine): add `capture` and `capture_duration` to rules loader
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2025-08-12 11:25:43 +02:00
e6cd74995c
new(userspace/falco): config parsing
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2025-08-12 11:25:43 +02:00
5ebfa1b05b
new: add config options and docs for `capture` feature
...
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2025-08-12 11:25:43 +02:00
539294595e
update(userspace/engine): bump engine version and checksum.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2025-08-04 17:12:50 +02:00
154cde354f
fix(userspace/falco): use proper API to fetch event param[0] as uint32_t.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2025-08-04 17:12:50 +02:00
ec24062b71
chore(userspace/falco): print plugin version info too at plugin loading.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2025-08-01 18:27:30 +02:00
3dce2f030d
fix(cmake,userspace): fix usage and build of mimalloc.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2025-07-25 16:58:43 +02:00
6a4fa5dfce
new(cmake,userspace/falco): add `mimalloc` allocator library support.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2025-07-25 16:58:43 +02:00
c3fc9e0d0f
fix(restart_handler): disable if there is no work
...
When there is no work to do, i.e. when all config watching is disabled,
there is no need to keep the restart_handler running. Disable it in this
case.
This is helpful to do on nodes where there is little to no headroom in
terms of open inotify watches (as per the inotify/max_user_instances
configuration), as can happen on nodes populated with other software
that also watch the filesystem for changes. If Falco is run on such a
node, it may fail to start due to functionality the app does not even
intend on using.
This has one change in terms of behaviour, however: the dry-run restarts
will no longer occur. As there is still never going to happen a real
restart, I understand it as unlikely for there to be a proper need for
dry-run restarts.
Signed-off-by: Mariell Hoversholm <mariell@grafana.com>
2025-07-24 12:56:39 +02:00
ca291b0eaf
update(userspace/engine): update falco engine version and checksum
...
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
2025-07-22 14:30:29 +02:00
ea9e86d9e0
update(userspace): bump engine version and checksum.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2025-06-30 14:25:18 +02:00
b2c76769cf
fix(userspace/falco): enforce filtercheck overlap check for static fields too against plugin fields.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
2025-06-30 14:25:18 +02:00
07266e1247
new(userspace/falco): append static filterchecks with static fields.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2025-06-30 14:25:18 +02:00
8d8ba5ba5c
new(userspace/falco): add new `static_fields` config key + update schema.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2025-06-30 14:25:18 +02:00
4418bf2101
update(userspace/engine): bump engine version and checksum.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2025-06-09 12:19:53 +02:00
7a349a3e87
update(userspace/engine): bump engine version and checksum.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2025-06-03 11:12:11 +02:00
9055811d79
fix(userspace/falco): when collecting metrics for stats_writer, create a `libs_metrics_collector` for each source.
...
In case multiple sources are enabled, each source has its own `libs_metrics_collector`
with correct flags, so that it can retrieve all metrics.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2025-06-02 10:42:59 +02:00
2346a397f7
chore(userspace/falco): fix build for non linux minimal builds.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2025-05-30 19:05:38 +02:00
24f92dfdbc
fix(userspace/falco): only enable prometheus metrics once all inspectors have been opened.
...
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2025-05-30 19:05:38 +02:00
a7433e032b
chore(userspace/falco): make re2 patterns statically lived.
...
Moreover, rename `falco_metrics::` methods to better expose
they return prometheus metrics.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Samuel Gaist <samuel.gaist@idiap.ch>
2025-05-28 09:47:16 +02:00
Iacopo Rozzo