libs
libs copied to clipboard
falcosecurity
fix(driver): silence drop enter/exit event delayed insert messages
such messages might end up flooding kernel logs. Silence them unless the "verbose" module parameter is enabled. Also, add information about the consumer.
Signed-off-by: Gerlando Falauto [email protected]
What type of PR is this?
Uncomment one (or more)
/kind <>lines:
/kind bug
/kind cleanup
/kind design
/kind documentation
/kind failing-test
/kind feature
Any specific area of the project related to this PR?
Uncomment one (or more)
/area <>lines:
/area build
/area driver-kmod
/area driver-ebpf
/area libscap
/area libsinsp
/area tests
/area proposals
What this PR does / why we need it: Removes noisy messages from kernel logs Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Does this PR introduce a user-facing change?:
Drop enter/exit event delayed messages are now only logged when in verbose mode
[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by: iurly
To complete the pull request process, please assign leogr after the PR has been reviewed.
You can assign the PR to them by writing /assign @leogr in a comment when ready.
The full list of commands accepted by this bot can be found here.
Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment
Hi @iurly. Thanks for your PR.
I'm waiting for a falcosecurity member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.
Once the patch is verified, the new status will be reflected by the ok-to-test label.
I understand the commands that are listed here.
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
Hi! Thanks for this PR!
Can't we use pr_debug or pr_notice instead of checking the verbose flag?
Hi! Thanks for this PR!
Can't we use pr_debug or pr_notice instead of checking the verbose flag?
Can't we use pr_debug or pr_notice instead of checking the verbose flag?
Good point. I just tried to be consistent with the existing approach -- though it would have been better to introduce a new vpr_error() macro instead.
Also, this approach allows to re-enable these messages by just adding the verbose parameter to the insmod -- not sure if/how the log level could be easily changed at runtime for that module only.
@iurly right, but the only use case atm was: https://github.com/falcosecurity/libs/blob/master/driver/main.c#L215, ie: used to check whether pr_info should be actually printed. That makes sense.
I am not sure how to proceed with an error level log, though.
I mean, if it is a real error, we should never hide it. Otherwise, we can lower its log level.
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle rotten
Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Provide feedback via https://github.com/falcosecurity/community. /close
@poiana: Closed this PR.
In response to this:
Rotten issues close after 30d of inactivity.
Reopen the issue with
/reopen.Mark the issue as fresh with
/remove-lifecycle rotten.Provide feedback via https://github.com/falcosecurity/community. /close
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.