falcosecurity
Grafana dashboard for new Falco metrics introduced in 0.38
Motivation
See https://github.com/falcosecurity/falco/issues/3132
Feature
Add a new Grafana dashboard for Falco metrics.
Additional context
- TBD: We still have to think about the shape of the dashboard and how to present the metrics.
/assign /assign @alacuku
Thanks @leogr for opening this dedicated issues.
Perhaps we need multiple dashboards.
- One dashboard could be tailored to replace https://github.com/falcosecurity/falco-exporter
- Another one could be focused on performance overhead tracking, we could use it for https://github.com/falcosecurity/cncf-green-review-testing/issues/12
- ... more specialized dashboards given that we have a lot of metrics users can tap into
@leogr another question re the rules counters. We sanitize the rules name to conform with the Open Metric standard. should we maybe add the original rules name (all original characters) as label as well so it can be displayed more nicely in the dashboard?
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
Hey, are there any available Grafana dashboards for the new exposed metrics? or any any PrometheusRule CRDs for Alerts on the new metrics?
@paltaa we're still working on the dashboard. The metrics feature is not stable yet, and the upcoming 0.39.0 will introduce breaking changes.
Here's an overview of the WIP: https://issif.grafana.net/dashboard/snapshot/esulWY0cuRhb31SlqFDUHw3KJDHS4bq7?from=2024-09-13T19:53:02.224Z&to=2024-09-18T19:07:10.632Z&timezone=browser&var-datasource=grafanacloud-prom&var-source=k8s_audit&var-source=syscall&var-priority=$__all&var-rule=$__all&refresh=
Hey @Issif, thanks for the quick response, could you share the JSON for that dashboard?
The dashboard has been integrated into the charts: https://github.com/falcosecurity/charts/pull/760
@alacuku: Closing this issue.
In response to this:
/close
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.