Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refactor and simplify legacy syscall_event_drops #3050

Open
incertum opened this issue Feb 1, 2024 · 4 comments
Open

Refactor and simplify legacy syscall_event_drops #3050

incertum opened this issue Feb 1, 2024 · 4 comments
Assignees
Milestone

Comments

@incertum
Copy link
Contributor

incertum commented Feb 1, 2024

Refactor and simplify legacy syscall_event_drops.

Previous discussion: #2910

Needs to address CVE-2019-8339 even better.
@leogr to provide more details.

@incertum
Copy link
Contributor Author

incertum commented Feb 1, 2024

/milestone 0.38.0

/assign @leogr

@poiana poiana added this to the 0.38.0 milestone Feb 1, 2024
@incertum
Copy link
Contributor Author

incertum commented Feb 1, 2024

Initial ideas:

  • Add an explicit enabled key to allow for easier opt out
  • By default enabled for all logging levels not just priority level debug
  • Only report global drop stats and instead point to metrics for detailed and continuous monitoring
  • Discuss alert volume implications -> opportunity to re-design and adopt a new approach

@poiana
Copy link

poiana commented May 1, 2024

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

@Andreagit97
Copy link
Member

/remove-lifecycle stale

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants