Blank charts in falcosidekick-ui but falco is working (ARM) #95

anthares101 · 2023-04-04T11:42:57Z

Describe the bug

The falcosidekick-ui is showing blank charts, I can see that in the top it is reporting the events though. Also, I can see that events are appearing in the Falco logs.

How to reproduce it

The installation command:

helm install falco falcosecurity/falco --namespace falco --create-na
mespace --values values.yaml

My values file:

driver:
  kind: ebpf

falcosidekick:
  enabled: true
  replicaCount: 1
  webui:
    enabled: true
    replicaCount: 1
    user: "REDACTED"
    ingress:
      enabled: true
      hosts:
      - host: falco.magi.lan
        paths:
        - path: /
      tls:
      - hosts:
        - falco.magi.lan

  config:
    customfields: "cluster:MAGI"

tolerations:
- effect: NoSchedule
  key: node-role.kubernetes.io/master
- effect: NoSchedule
  key: node-role.kubernetes.io/control-plane
- key: CriticalAddonsOnly
  operator: Exists
  effect: NoSchedule

Expected behaviour

The UI charts should be populated with falco events.

Screenshots

Environment

Falco version:
Falco version: 0.34.1 (aarch64)
System info:

{
  "machine": "aarch64",
  "nodename": "falco-6s564",
  "release": "6.1.19-v8+",
  "sysname": "Linux",
  "version": "#1637 SMP PREEMPT Tue Mar 14 11:11:47 GMT 2023"
}

Cloud provider or hardware configuration:
3 nodes K3S cluster, the nodes are raspberry pi 4 b with 4GB of RAM each.
OS:
Debian GNU/Linux 11 (raspbian bullseye)
Kernel:
Linux 6.1.19-v8+ #1637 SMP PREEMPT Tue Mar 14 11:11:47 GMT 2023 aarch64 GNU/Linux
Installation method:
Falco Helm chart

Issif · 2023-04-04T11:47:18Z

What are the logs in Falcosidekick pods?

anthares101 · 2023-04-04T11:58:28Z

Thanks for the early response!

falco-falcosidekick pod:

2023/04/04 11:51:06 [INFO]  : Falco Sidekick version: 2.27.0
2023/04/04 11:51:06 [INFO]  : Enabled Outputs : [WebUI]
2023/04/04 11:51:06 [INFO]  : Falco Sidekick is up and listening on :2801
2023/04/04 11:52:39 [INFO]  : WebUI - Post OK (200)
2023/04/04 11:53:06 [INFO]  : WebUI - Post OK (200)
2023/04/04 11:53:08 [INFO]  : WebUI - Post OK (200)
2023/04/04 11:53:23 [INFO]  : WebUI - Post OK (200)
2023/04/04 11:53:24 [INFO]  : WebUI - Post OK (200)
2023/04/04 11:53:25 [INFO]  : WebUI - Post OK (200)
2023/04/04 11:53:33 [INFO]  : WebUI - Post OK (200)

falco-falcosidekick-ui pod:

2023/04/04 11:51:30 [WARN] : Index does not exist
2023/04/04 11:51:30 [WARN] : Create Index
2023/04/04 11:51:30 [INFO] : Falcosidekick UI is listening on 0.0.0.0:2802
2023/04/04 11:51:30 [INFO] : log level is info
2023/04/04 11:56:38 [INFO] : user 'admin' authenticated

falco-falcosidekick-ui-redis

9:C 04 Apr 2023 11:51:07.412 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
9:C 04 Apr 2023 11:51:07.412 # Redis version=6.2.10, bits=64, commit=00000000, modified=0, pid=9, just started
9:C 04 Apr 2023 11:51:07.412 # Configuration loaded
9:M 04 Apr 2023 11:51:07.419 * monotonic clock: POSIX clock_gettime
9:M 04 Apr 2023 11:51:07.423 * Running mode=standalone, port=6379.
9:M 04 Apr 2023 11:51:07.423 # Server initialized
9:M 04 Apr 2023 11:51:07.462 * <search> Redis version found by RedisSearch : 6.2.10 - oss
9:M 04 Apr 2023 11:51:07.462 * <search> RediSearch version 2.6.5 (Git=HEAD-71bd22f3)
9:M 04 Apr 2023 11:51:07.462 * <search> Low level api version 1 initialized successfully
9:M 04 Apr 2023 11:51:07.462 * <search> concurrent writes: OFF, gc: ON, prefix min length: 2, prefix max expansions: 200, query timeout (ms): 500, timeout policy: return, cursor read size: 1000, cursor max idle (ms): 300000, max doctable size: 1000000, max number of search results:  10000, search pool size: 20, index pool size: 8,
9:M 04 Apr 2023 11:51:07.466 * <search> Initialized thread pool!
9:M 04 Apr 2023 11:51:07.466 * <search> Enabled diskless replication
9:M 04 Apr 2023 11:51:07.466 * <search> Enabled role change notification
9:M 04 Apr 2023 11:51:07.467 * Module 'search' loaded from /opt/redis-stack/lib/redisearch.so
9:M 04 Apr 2023 11:51:07.491 * <graph> Starting up RedisGraph version 2.10.8.
9:M 04 Apr 2023 11:51:07.510 * <graph> Thread pool created, using 4 threads.
9:M 04 Apr 2023 11:51:07.510 * <graph> Maximum number of OpenMP threads set to 4
9:M 04 Apr 2023 11:51:07.510 * Module 'graph' loaded from /opt/redis-stack/lib/redisgraph.so
9:M 04 Apr 2023 11:51:07.511 * <timeseries> RedisTimeSeries version 10805, git_sha=a7a296c8f3f6e312811032233a468d57d45957ca
9:M 04 Apr 2023 11:51:07.511 * <timeseries> Redis version found by RedisTimeSeries : 6.2.10 - oss
9:M 04 Apr 2023 11:51:07.511 * <timeseries> loaded default CHUNK_SIZE_BYTES policy: 4096
9:M 04 Apr 2023 11:51:07.511 * <timeseries> loaded server DUPLICATE_POLICY: block
9:M 04 Apr 2023 11:51:07.511 * <timeseries> Setting default series ENCODING to: compressed
9:M 04 Apr 2023 11:51:07.511 * <timeseries> Detected redis oss
9:M 04 Apr 2023 11:51:07.519 * <timeseries> Enabled diskless replication
9:M 04 Apr 2023 11:51:07.519 * Module 'timeseries' loaded from /opt/redis-stack/lib/redistimeseries.so
9:M 04 Apr 2023 11:51:07.520 * <ReJSON> version: 20404 git sha: eb5eba8 branch: HEAD
9:M 04 Apr 2023 11:51:07.520 * <ReJSON> Exported RedisJSON_V1 API
9:M 04 Apr 2023 11:51:07.520 * <ReJSON> Exported RedisJSON_V2 API
9:M 04 Apr 2023 11:51:07.520 * <ReJSON> Exported RedisJSON_V3 API
9:M 04 Apr 2023 11:51:07.520 * <ReJSON> Enabled diskless replication
9:M 04 Apr 2023 11:51:07.520 * <ReJSON> Created new data type 'ReJSON-RL'
9:M 04 Apr 2023 11:51:07.520 * Module 'ReJSON' loaded from /opt/redis-stack/lib/rejson.so
9:M 04 Apr 2023 11:51:07.520 * <search> Acquired RedisJSON_V3 API
9:M 04 Apr 2023 11:51:07.520 * <graph> Acquired RedisJSON_V1 API
9:M 04 Apr 2023 11:51:07.524 * <bf> RedisBloom version 2.4.4 (Git=unknown)
9:M 04 Apr 2023 11:51:07.524 * Module 'bf' loaded from /opt/redis-stack/lib/redisbloom.so
9:M 04 Apr 2023 11:51:07.526 * Ready to accept connections
9:M 04 Apr 2023 11:56:08.003 * 100 changes in 300 seconds. Saving...
9:M 04 Apr 2023 11:56:08.005 * Background saving started by pid 35
35:C 04 Apr 2023 11:56:08.013 * DB saved on disk
35:C 04 Apr 2023 11:56:08.015 * RDB: 0 MB of memory used by copy-on-write
9:M 04 Apr 2023 11:56:08.106 * Background saving terminated with success

Issif · 2023-04-04T12:10:29Z

The logs are 100% normal. I saw you issue in the charts repo, I may have break something for people using an Ingress with falcosidekick-UI by adding an auth mechanism. The strangest is you get the global counts in the header. Do you have any failures in your browser console?

anthares101 · 2023-04-04T12:13:39Z

The console is empty sadly 😢

Issif · 2023-04-04T12:21:58Z

No request with 401 error?

anthares101 · 2023-04-04T12:29:10Z

I would like to say yes but no...:

Issif · 2023-04-04T12:32:18Z

O_o no error in the logs, no error in the console, no error in the requests.

Can you try:

to access directly to the falcosidekick-ui service with a port-forward
change Since filter for a longer period

anthares101 · 2023-04-04T12:51:42Z

Same result using the port forwarding method:
The since filter did not help either

It is weird I know 😅, the most annoying thing is that the header is working as expected for some reason xD

Issif · 2023-04-04T13:12:01Z

Select 1Y for Since to see if it's not an issue with Dates please

anthares101 · 2023-04-04T13:19:37Z

Screenshots with the since filter set to 1Y:

Issif · 2023-04-04T13:32:31Z

This is a mystery, I don't understand what's happening 😭

anthares101 · 2023-04-04T13:53:03Z

Yeah... it is really frustrating 😭

Issif · 2023-04-04T13:57:41Z

I never noticed a such strange behavior, are you available on kubernetes.slack.com #falco? It will be easier to help I think.

anthares101 · 2023-04-04T15:00:07Z

Nope, but I guess I can just create an account for it

xinity · 2023-04-04T15:00:41Z

same here :(

Issif · 2023-04-04T17:43:10Z

For people facing the same issue, it is scoped to arm64 users.

poiana · 2023-07-03T19:31:45Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana · 2023-08-02T19:32:35Z

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

anthares101 · 2023-08-02T20:33:37Z

/remove-lifecycle rotten

poiana · 2023-10-31T21:46:01Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

anthares101 · 2023-10-31T21:49:22Z

/remove-lifecycle stale

poiana · 2024-01-30T03:48:29Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

anthares101 · 2024-02-08T17:17:28Z

/remove-lifecycle stale

anthares101 added the kind/bug Something isn't working label Apr 4, 2023

anthares101 mentioned this issue Apr 4, 2023

Blank charts in falcosidekick-ui but falco is working falcosecurity/charts#477

Closed

anthares101 changed the title ~~Blank charts in falcosidekick-ui but falco is working~~ Blank charts in falcosidekick-ui but falco is working (ARM64) Apr 4, 2023

anthares101 changed the title ~~Blank charts in falcosidekick-ui but falco is working (ARM64)~~ Blank charts in falcosidekick-ui but falco is working (ARM) Apr 4, 2023

Issif mentioned this issue Jun 7, 2023

Integration between Falco and FalcoSidekick falcosecurity/falco#2565

Closed

poiana added the lifecycle/stale label Jul 3, 2023

poiana added lifecycle/rotten and removed lifecycle/stale labels Aug 2, 2023

poiana removed the lifecycle/rotten label Aug 2, 2023

poiana added the lifecycle/stale label Oct 31, 2023

poiana removed the lifecycle/stale label Oct 31, 2023

poiana added the lifecycle/stale label Jan 30, 2024

poiana removed the lifecycle/stale label Feb 8, 2024

Issif self-assigned this Apr 30, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Blank charts in falcosidekick-ui but falco is working (ARM) #95

Blank charts in falcosidekick-ui but falco is working (ARM) #95

anthares101 commented Apr 4, 2023

Issif commented Apr 4, 2023

anthares101 commented Apr 4, 2023

Issif commented Apr 4, 2023

anthares101 commented Apr 4, 2023

Issif commented Apr 4, 2023

anthares101 commented Apr 4, 2023

Issif commented Apr 4, 2023

anthares101 commented Apr 4, 2023

Issif commented Apr 4, 2023

anthares101 commented Apr 4, 2023

Issif commented Apr 4, 2023

anthares101 commented Apr 4, 2023

Issif commented Apr 4, 2023

anthares101 commented Apr 4, 2023

xinity commented Apr 4, 2023

Issif commented Apr 4, 2023

poiana commented Jul 3, 2023

poiana commented Aug 2, 2023

anthares101 commented Aug 2, 2023

poiana commented Oct 31, 2023

anthares101 commented Oct 31, 2023

poiana commented Jan 30, 2024

anthares101 commented Feb 8, 2024

Blank charts in falcosidekick-ui but falco is working (ARM) #95

Blank charts in falcosidekick-ui but falco is working (ARM) #95

Comments

anthares101 commented Apr 4, 2023

Issif commented Apr 4, 2023

anthares101 commented Apr 4, 2023

Issif commented Apr 4, 2023

anthares101 commented Apr 4, 2023

Issif commented Apr 4, 2023

anthares101 commented Apr 4, 2023

Issif commented Apr 4, 2023

anthares101 commented Apr 4, 2023

Issif commented Apr 4, 2023

anthares101 commented Apr 4, 2023

Issif commented Apr 4, 2023

anthares101 commented Apr 4, 2023

Issif commented Apr 4, 2023

anthares101 commented Apr 4, 2023

xinity commented Apr 4, 2023

Issif commented Apr 4, 2023

poiana commented Jul 3, 2023

poiana commented Aug 2, 2023

anthares101 commented Aug 2, 2023

poiana commented Oct 31, 2023

anthares101 commented Oct 31, 2023

poiana commented Jan 30, 2024

anthares101 commented Feb 8, 2024