Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(falco_metrics): fix prometheus metrics to be compliant with best practices #3337

Merged
merged 4 commits into from
Sep 23, 2024
Merged

fix(falco_metrics): fix prometheus metrics to be compliant with best practices #3337

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5e5e04e
fix(falco_metrics)!: split tags label into multiple tag_ labels
ekoops Sep 20, 2024
7e07643
fix(falco_metrics)!: use full name for configs and rules files
ekoops Sep 20, 2024
90a5fd6
fix(falco_metrics): remove ifinfo_json stat/metric
ekoops Sep 23, 2024
d6fe0d9
cleanup(falco_metrics): remove unused falco_utils import
ekoops Sep 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 8 additions & 41 deletions userspace/falco/falco_metrics.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,6 @@ limitations under the License.

#include "falco_metrics.h"

#include "falco_utils.h"

#include "app/state.h"

#include <libsinsp/sinsp.h>
Expand Down Expand Up @@ -102,48 +100,15 @@ std::string falco_metrics::to_text(const falco::app::state& state)
for (const auto& item : state.config.get()->m_loaded_rules_filenames_sha256sum)
{
fs::path fs_path = item.first;
prometheus_text += prometheus_metrics_converter.convert_metric_to_text_prometheus("sha256_rules_files", "falcosecurity", "falco", {{"file_name", fs_path.filename().stem()}, {"sha256", item.second}});
prometheus_text += prometheus_metrics_converter.convert_metric_to_text_prometheus("sha256_rules_files", "falcosecurity", "falco", {{"file_name", fs_path.filename()}, {"sha256", item.second}});
}

for (const auto& item : state.config.get()->m_loaded_configs_filenames_sha256sum)
{
fs::path fs_path = item.first;
prometheus_text += prometheus_metrics_converter.convert_metric_to_text_prometheus("sha256_config_files", "falcosecurity", "falco", {{"file_name", fs_path.filename().stem()}, {"sha256", item.second}});
}

static std::string ifinfo_json_escaped;
auto ipv4list = inspector->get_ifaddr_list().get_ipv4_list();
auto ipv6list = inspector->get_ifaddr_list().get_ipv6_list();
nlohmann::json ipv4_json;
nlohmann::json ipv6_json;
if(ipv4list)
{
for (const auto& item : *ipv4list)
{
if(item.m_name == "lo")
{
continue;
}
ipv4_json[item.m_name] = item.addr_to_string();
}
prometheus_text += prometheus_metrics_converter.convert_metric_to_text_prometheus("sha256_config_files", "falcosecurity", "falco", {{"file_name", fs_path.filename()}, {"sha256", item.second}});
}

if(ipv6list)
{
for (const auto& item : *ipv6list)
{
if(item.m_name == "lo")
{
continue;
}
ipv6_json[item.m_name] = item.addr_to_string();
}
}
nlohmann::json ifinfo_json;
ifinfo_json["ipv4"] = ipv4_json;
ifinfo_json["ipv6"] = ipv6_json;
ifinfo_json_escaped = ifinfo_json.dump();
prometheus_text += prometheus_metrics_converter.convert_metric_to_text_prometheus("host_ifinfo_json", "falcosecurity", "falco", {{"host_ifinfo_json", ifinfo_json_escaped}});
#endif

for (const std::string& source: inspector->event_sources())
Expand Down Expand Up @@ -218,10 +183,10 @@ std::string falco_metrics::to_text(const falco::app::state& state)
/* Examples ...
# HELP falcosecurity_falco_rules_matches_total https://falco.org/docs/metrics/
# TYPE falcosecurity_falco_rules_matches_total counter
falcosecurity_falco_rules_matches_total{priority="4",rule_name="Read sensitive file untrusted",source="syscall",tags="T1555, container, filesystem, host, maturity_stable, mitre_credential_access"} 10
falcosecurity_falco_rules_matches_total{priority="4",rule_name="Read sensitive file untrusted",source="syscall",tag_T1555="true",tag_container="true",tag_filesystem="true",tag_host="true",tag_maturity_stable="true",tag_mitre_credential_access="true"} 10
# HELP falcosecurity_falco_rules_matches_total https://falco.org/docs/metrics/
# TYPE falcosecurity_falco_rules_matches_total counter
falcosecurity_falco_rules_matches_total{priority="5",rule_name="Unexpected UDP Traffic",source="syscall",tags="TA0011, container, host, maturity_incubating, mitre_exfiltration, network"} 1
falcosecurity_falco_rules_matches_total{priority="5",rule_name="Unexpected UDP Traffic",source="syscall",tag_TA0011="true",tag_container="true",tag_host="true",tag_maturity_incubating="true",tag_mitre_exfiltration="true",tag_network="true"} 1
*/
auto metric = libs::metrics::libsinsp_metrics::new_metric("rules_matches",
METRICS_V2_RULE_COUNTERS,
Expand All @@ -230,12 +195,14 @@ std::string falco_metrics::to_text(const falco::app::state& state)
METRIC_VALUE_METRIC_TYPE_MONOTONIC,
rules_by_id[i]->load());
prometheus_metrics_converter.convert_metric_to_unit_convention(metric);
const std::map<std::string, std::string>& const_labels = {
std::map<std::string, std::string> const_labels = {
{"rule_name", rule->name},
{"priority", std::to_string(rule->priority)},
{"source", rule->source},
{"tags", concat_set_in_order(rule->tags)}
};
std::for_each(rule->tags.cbegin(), rule->tags.cend(), [&const_labels](std::string const& tag) {
const_labels.emplace(std::string{"tag_"} + tag, "true");
});
prometheus_text += prometheus_metrics_converter.convert_metric_to_text_prometheus(metric, "falcosecurity", "falco", const_labels);
}
}
Expand Down
37 changes: 2 additions & 35 deletions userspace/falco/stats_writer.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -345,52 +345,19 @@ void stats_writer::collector::get_metrics_output_fields_wrapper(
for (const auto& item : m_writer->m_config->m_loaded_rules_filenames_sha256sum)
{
fs::path fs_path = item.first;
std::string metric_name_file_sha256 = fs_path.filename().stem();
std::string metric_name_file_sha256 = fs_path.filename();
metric_name_file_sha256 = "falco.sha256_rules_file." + falco::utils::sanitize_rule_name(metric_name_file_sha256);
output_fields[metric_name_file_sha256] = item.second;
}

for (const auto& item : m_writer->m_config->m_loaded_configs_filenames_sha256sum)
{
fs::path fs_path = item.first;
std::string metric_name_file_sha256 = fs_path.filename().stem();
std::string metric_name_file_sha256 = fs_path.filename();
metric_name_file_sha256 = "falco.sha256_config_file." + falco::utils::sanitize_rule_name(metric_name_file_sha256);
output_fields[metric_name_file_sha256] = item.second;
}

auto ipv4list = inspector->get_ifaddr_list().get_ipv4_list();
auto ipv6list = inspector->get_ifaddr_list().get_ipv6_list();
nlohmann::json ipv4_json;
nlohmann::json ipv6_json;
if(ipv4list)
{
for (const auto& item : *ipv4list)
{
if(item.m_name == "lo")
{
continue;
}
ipv4_json[item.m_name] = item.addr_to_string();
}
}

if(ipv6list)
{
for (const auto& item : *ipv6list)
{
if(item.m_name == "lo")
{
continue;
}
ipv6_json[item.m_name] = item.addr_to_string();
}
}
nlohmann::json ifinfo_json;
ifinfo_json["ipv4"] = ipv4_json;
ifinfo_json["ipv6"] = ipv6_json;
m_ifinfo_json_escaped = ifinfo_json.dump();
output_fields["falco.host_ifinfo_json"] = m_ifinfo_json_escaped;

#endif
output_fields["evt.source"] = src;
for (size_t i = 0; i < sizeof(all_driver_engines) / sizeof(const char*); i++)
Expand Down
1 change: 0 additions & 1 deletion userspace/falco/stats_writer.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,6 @@ class stats_writer
uint64_t m_last_n_evts = 0;
uint64_t m_last_n_drops = 0;
uint64_t m_last_num_evts = 0;
std::string m_ifinfo_json_escaped;
};

stats_writer(const stats_writer&) = delete;
Expand Down
Loading