Melissa Kilby

/remove-lifecycle stale we are still on it and just added new libsinsp state metrics also around the container engine -> let's see what the data reveal in next 2 weeks.

@jemag perfect timing: We just merged a PR aimed to improve things, see my comment here: https://github.com/falcosecurity/falco/issues/2708#issuecomment-1969575503. I hope you will be able to benefit from these improvements starting with...

/remove-lifecycle stale

@Caroline132 would it be possible to give Falco 0.38.0 a try and see if things have slightly improved? We never expect it to be perfect since API lookups take few...

Hey @Caroline132 statistically what percentage of containers in the logs are null? Could you add container.duration output field? [Please note that if a container just starts we need to make...

@Caroline132 thanks for reporting back. I am currently unsure why you see null values for all container info fields in only a subset of rules, and I don't know how...

One more thought: Maybe worth a try also exporting `k8s.pod.sandbox_id` and if it's the same as the `contaienr.id` then the rules in question trigger on sandbox containers that do not...

Thanks for the additional info. It seems like all requests are just failing for that container and you hit this code block https://github.com/falcosecurity/libs/blob/74725244659e556ced587c2f0bec7bbd42d39b96/userspace/libsinsp/cri.hpp#L775-L778 so it seems. Which is extremely strange...

/remove-lifecycle stale

We haven't gotten to it, so 0.39.0 is perfect. Thanks!