From 4908fe5ef14698a4abee7b3709a85572cffbb245 Mon Sep 17 00:00:00 2001 From: Gianmatteo Palmieri Date: Thu, 30 May 2024 17:39:53 +0200 Subject: [PATCH] new(metrics): enable plugins metrics Signed-off-by: Gianmatteo Palmieri Co-authored-by: Melissa Kilby --- falco.yaml | 6 ++++++ userspace/falco/configuration.cpp | 6 +++++- userspace/falco/falco_metrics.cpp | 7 +++++++ userspace/falco/stats_writer.cpp | 32 +++++++++++++++++++++++++++++++ 4 files changed, 50 insertions(+), 1 deletion(-) diff --git a/falco.yaml b/falco.yaml index 3be86413e68..a5fbcb269e5 100644 --- a/falco.yaml +++ b/falco.yaml @@ -1037,6 +1037,11 @@ syscall_event_drops: # beneficial for exploring the data schema and ensuring that fields with empty # values are included in the output. # +# `plugins_metrics_enabled`: Falco can now expose your custom plugins' +# metrics. Please note that if the respective plugin has no metrics implemented, +# there will be no metrics available. In other words, there are no default or +# generic plugin metrics at this time. This may be subject to change. +# # If metrics are enabled, the web server can be configured to activate the # corresponding Prometheus endpoint using `webserver.prometheus_metrics_enabled`. # Prometheus output can be used in combination with the other output options. @@ -1055,6 +1060,7 @@ metrics: state_counters_enabled: true kernel_event_counters_enabled: true libbpf_stats_enabled: true + plugins_metrics_enabled: true convert_memory_to_mb: true include_empty_values: false diff --git a/userspace/falco/configuration.cpp b/userspace/falco/configuration.cpp index c4f2df50a90..88e03a91edc 100644 --- a/userspace/falco/configuration.cpp +++ b/userspace/falco/configuration.cpp @@ -72,7 +72,7 @@ falco_configuration::falco_configuration(): m_metrics_interval(5000), m_metrics_stats_rule_enabled(false), m_metrics_output_file(""), - m_metrics_flags((METRICS_V2_KERNEL_COUNTERS | METRICS_V2_LIBBPF_STATS | METRICS_V2_RESOURCE_UTILIZATION | METRICS_V2_STATE_COUNTERS | METRICS_V2_RULE_COUNTERS)), + m_metrics_flags(0), m_metrics_convert_memory_to_mb(true), m_metrics_include_empty_values(false) { @@ -555,6 +555,10 @@ void falco_configuration::load_yaml(const std::string& config_name) { m_metrics_flags |= METRICS_V2_LIBBPF_STATS; } + if (config.get_scalar("metrics.plugins_metrics_enabled", true)) + { + m_metrics_flags |= METRICS_V2_PLUGINS; + } m_metrics_convert_memory_to_mb = config.get_scalar("metrics.convert_memory_to_mb", true); m_metrics_include_empty_values = config.get_scalar("metrics.include_empty_values", false); diff --git a/userspace/falco/falco_metrics.cpp b/userspace/falco/falco_metrics.cpp index 7731f25ed28..95dd24248a1 100644 --- a/userspace/falco/falco_metrics.cpp +++ b/userspace/falco/falco_metrics.cpp @@ -222,10 +222,17 @@ std::string falco_metrics::to_text(const falco::app::state& state) { prometheus_metrics_converter.convert_metric_to_unit_convention(metric); std::string namespace_name = "scap"; + if (metric.flags & METRICS_V2_RESOURCE_UTILIZATION || metric.flags & METRICS_V2_KERNEL_COUNTERS) { namespace_name = "falco"; } + + if (metric.flags & METRICS_V2_PLUGINS) + { + namespace_name = "plugins"; + } + prometheus_text += prometheus_metrics_converter.convert_metric_to_text_prometheus(metric, "falcosecurity", namespace_name); } diff --git a/userspace/falco/stats_writer.cpp b/userspace/falco/stats_writer.cpp index 29efefd7f97..17fb8bc173d 100644 --- a/userspace/falco/stats_writer.cpp +++ b/userspace/falco/stats_writer.cpp @@ -440,6 +440,10 @@ void stats_writer::collector::get_metrics_output_fields_additional( { strlcpy(metric_name, "scap.", sizeof(metric_name)); } + if(metric.flags & METRICS_V2_PLUGINS) + { + strlcpy(metric_name, "plugins.", sizeof(metric_name)); + } strlcat(metric_name, metric.name, sizeof(metric_name)); switch (metric.type) @@ -451,6 +455,13 @@ void stats_writer::collector::get_metrics_output_fields_additional( } output_fields[metric_name] = metric.value.u32; break; + case METRIC_VALUE_TYPE_S32: + if (metric.value.s32 == 0 && !m_writer->m_config->m_metrics_include_empty_values) + { + break; + } + output_fields[metric_name] = metric.value.s32; + break; case METRIC_VALUE_TYPE_U64: if (strncmp(metric.name, "n_evts", 7) == 0) { @@ -492,6 +503,13 @@ void stats_writer::collector::get_metrics_output_fields_additional( } output_fields[metric_name] = metric.value.u64; break; + case METRIC_VALUE_TYPE_S64: + if (metric.value.s64 == 0 && !m_writer->m_config->m_metrics_include_empty_values) + { + break; + } + output_fields[metric_name] = metric.value.s64; + break; case METRIC_VALUE_TYPE_D: if (metric.value.d == 0 && !m_writer->m_config->m_metrics_include_empty_values) { @@ -499,6 +517,20 @@ void stats_writer::collector::get_metrics_output_fields_additional( } output_fields[metric_name] = metric.value.d; break; + case METRIC_VALUE_TYPE_F: + if (metric.value.f == 0 && !m_writer->m_config->m_metrics_include_empty_values) + { + break; + } + output_fields[metric_name] = metric.value.f; + break; + case METRIC_VALUE_TYPE_I: + if (metric.value.i == 0 && !m_writer->m_config->m_metrics_include_empty_values) + { + break; + } + output_fields[metric_name] = metric.value.i; + break; default: break; }