Falco: ROADMAP: Prometheus Metrics Exporter

[mfdii]

Description: Export prometheus metrics via a /metrics endpoint. Metrics would include:

• Total rules triggered
• Events dropped
• Count of rules triggered by:
  
  
  
  • rule name
  
  
  • rule event source
  
  
  • rule tag
  
  
• Alerts sent
• Alerts failed to send
  
  
  
  • Total
  
  
  • by output
  
  

Skills required: C++, Familiar with prometheus metrics format (OpenMetrics).

[mfdii]

This needs to get added to Google SOC project ideas.

[JPLachance]

Creating a metrics endpoint for Falco was also proposed in issue #421.

[leodido]

/kind feature

[LoganSteinberg]

Hey, I was thinking of picking this up.
I was curious if anyone has an idea what progress, if any, was made before it was moved back to 'To do' incase there's a base I should be working off of?
@mfdii since you moved it back to 'To do'

[leodido]

Hey @LoganSteinberg thanks to @leogr we have an initial work done in this direction.

Look to the falco-exporter repo.

Would you mind contributing there? Contributions will be very welcome! :)

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[Issif]

For those who use falcosidekick, the last release embbeds a prom exporter : https://github.com/falcosecurity/falcosidekick#prometheus

[leogr]

I believe we can say this is done since both falco-exporter and falcosidekick can be used for metrics.
Likely, we will also get metrics about drops soon (see https://github.com/falcosecurity/falco/pull/1451).

/close

[poiana]

@leogr: Closing this issue.

In response to this:

I believe we can say this is done since both falco-exporter and falcosidekick can be used for metrics.
Likely, we will also get metrics about drops soon (see https://github.com/falcosecurity/falco/pull/1451).

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.