You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
To help with troubleshooting make Falco more verbose if requested. This means:
Adding more logging with TRACE level when Falco combines information from
various sources into one entity. Normally we could get quite a good picture
about which events do we receive, but how those events are assembled is a
black box. The obvious parts are:
scap_linux_proc_get, where Falco reads information from procfs
ContainerEnginer::resolve, where we match a process with a container id
sinsp_threadinfo::add_child, where Falco establish dependencies between
processes
sinsp_threadinfo::set_user, where Falco matches a process with uid/gid
set_ipv4/6_mapped_ipv6_addresses_and_ports, where Falco matches socket
information with a file descriptor
This is of course subject to the overhead evaluation.
Adding more logging with DEBUG level to initialization actions
BPF program loading & attaching
Preparing tail calling prog array
Preparing & loading ringbuf, aux, settings and filter maps
Usually it's easy to figure out the actual place of an issue, but we lack
context and arguments, so add to the logging more details about maps & progs
(e.g. a frequent error after messing around with maps is loading one with
incorrect parameters, key size or such).
To help with troubleshooting make Falco more verbose if requested. This means:
Adding more logging with TRACE level when Falco combines information from
various sources into one entity. Normally we could get quite a good picture
about which events do we receive, but how those events are assembled is a
black box. The obvious parts are:
processes
information with a file descriptor
This is of course subject to the overhead evaluation.
Adding more logging with DEBUG level to initialization actions
Usually it's easy to figure out the actual place of an issue, but we lack
context and arguments, so add to the logging more details about maps & progs
(e.g. a frequent error after messing around with maps is loading one with
incorrect parameters, key size or such).
Part of #1320
The text was updated successfully, but these errors were encountered: