Falco integration metrics
The official Datadog integration for monitoring Falco. It collects 50 metrics.
Official summary
Gain insights into Falco alert logs and metrics
Metric types
- count (occurrences in the interval): 30
- gauge (value at a point in time): 20
Metrics
Descriptions are the official definitions, unedited.
| Metric | Type | Unit |
|---|---|---|
falco.Memory usage of the Falco process in container deployments (similar to container_memory_working_set_bytes) | gauge | byte |
falco.CPU usage percentage of the Falco process (equivalent to ps output) | gauge | - |
falco.Total duration in seconds that Falco has been running | count | second |
falco.Hostname information | gauge | - |
falco.Event source information (e.g. syscall or plugin-based sources) | gauge | - |
falco.Overall CPU usage percentage of all running processes on the host system | gauge | - |
falco.Overall memory usage in bytes of all running processes on the host system | gauge | byte |
falco.Total number of CPUs on the host system | gauge | cpu |
falco.Total number of open file descriptors on the host system | gauge | file |
falco.Number of currently running processes on the host system (from /proc/stat) | gauge | process |
falco.Active memory allocation by jemalloc memory allocator | count | byte |
falco.Total allocated memory by jemalloc memory allocator | count | byte |
falco.Memory mapped by jemalloc memory allocator | count | byte |
falco.Memory used for jemalloc metadata | count | byte |
falco.Transparent huge page memory used for jemalloc metadata | count | byte |
falco.Resident memory held by jemalloc memory allocator | count | byte |
falco.Memory retained by jemalloc for future allocations | count | byte |
falco.Memory from zero-sized reallocations in jemalloc | count | byte |
falco.Kernel release version information | gauge | - |
falco.Proportional Set Size memory usage of the Falco process | gauge | byte |
falco.Resident Set Size memory usage of the Falco process | gauge | byte |
falco.Virtual Set Size memory usage of the Falco process | gauge | byte |
falco.Total number of events dropped from the output queue | count | - |
falco.Total number of rule matches detected by Falco security rules | count | - |
falco.SCAP engine information (e.g. bpf modern_bpf or kmod) | gauge | - |
falco.Total number of file descriptors added to the internal tracking tables | count | file |
falco.Total number of threads added to the internal tracking tables | count | thread |
falco.Total number of successful file descriptor lookups from cache | count | - |
falco.Total number of successful thread lookups from cache | count | - |
falco.Current number of containers being tracked | gauge | - |
falco.Total number of events dropped due to buffer issues | count | - |
falco.Total number of kernel-side event drops | count | - |
falco.Total number of events dropped due to full thread table | count | - |
falco.Total number of events dropped due to scratch map issues | count | - |
falco.Total number of events captured by the system call capture engine | count | - |
falco.Total number of failed file descriptor lookups | count | file |
falco.Total number of failed thread lookups | count | - |
falco.Current number of file descriptors stored in internal tables | gauge | file |
falco.Number of containers with missing or unknown container images | gauge | - |
falco.Total number of non-cached file descriptor lookups | count | file |
falco.Total number of non-cached thread lookups | count | - |
falco.Total number of file descriptors removed from internal tracking tables | count | file |
falco.Total number of threads removed from internal tracking tables | count | thread |
falco.Total number of events dropped during retrieval process | count | - |
falco.Total number of events successfully retrieved from kernel | count | - |
falco.Total number of events dropped during storage process | count | - |
falco.Total number of events successfully stored | count | - |
falco.Current number of threads stored in internal tracking tables | gauge | thread |
falco.SHA256 hash information of Falco configuration files | gauge | - |
falco.SHA256 hash information of Falco rules files | gauge | - |
Official documentation
Metric names and descriptions are the official Datadog integration definitions (Copyright Datadog, Inc., BSD-3-Clause), reproduced unedited. The full license terms are on the About page.