stackrox/collector

[ROX-18272] Reinstate EBPF fallbacks

Closed this issue · 1 comments

Change "hard failure" mode to more user-friendly "soft failure" in the following cases:

  • Heuristic hard fail
  • Fallback to the next available collection method during the probe load

See ROX-18272 for more high-level details.

Quick comment on the heuristic hard fail, back when we had kernel module support (a couple of weeks ago), we used to check for ebpf support and fallback to kernel module in case it wasn't supported, we also changed from kernel module to ebpf on some platforms we know require modules to be signed. These collection method changes happened seamlessly for users, collector just emitted a warning message, we might want to consider something similar for CO-RE BPF in the near future.