Log major Falco stages
Opened this issue · 0 comments
To help with troubleshooting make Falco more verbose if requested. This means:
-
Adding more logging with TRACE level when Falco combines information from
various sources into one entity. Normally we could get quite a good picture
about which events do we receive, but how those events are assembled is a
black box. The obvious parts are:- scap_linux_proc_get, where Falco reads information from procfs
- ContainerEnginer::resolve, where we match a process with a container id
- sinsp_threadinfo::add_child, where Falco establish dependencies between
processes - sinsp_threadinfo::set_user, where Falco matches a process with uid/gid
- set_ipv4/6_mapped_ipv6_addresses_and_ports, where Falco matches socket
information with a file descriptor
This is of course subject to the overhead evaluation.
-
Adding more logging with DEBUG level to initialization actions
- BPF program loading & attaching
- Preparing tail calling prog array
- Preparing & loading ringbuf, aux, settings and filter maps
Usually it's easy to figure out the actual place of an issue, but we lack
context and arguments, so add to the logging more details about maps & progs
(e.g. a frequent error after messing around with maps is loading one with
incorrect parameters, key size or such).
Part of #1320