Falco インテグレーションのメトリクス
Falco の監視に使う Datadog の公式インテグレーションです。収集するメトリクスは 50 件あります。
公式の紹介文 (英語)
Gain insights into Falco alert logs and metrics
種別の内訳
- count (集計間隔内の発生回数): 30 件
- gauge (その時点の値): 20 件
メトリクスの一覧
説明は公式の定義の英文をそのまま載せています。
| メトリクス | 種別 | 単位 |
|---|---|---|
falco.Memory usage of the Falco process in container deployments (similar to container_memory_working_set_bytes) | gauge | byte |
falco.CPU usage percentage of the Falco process (equivalent to ps output) | gauge | - |
falco.Total duration in seconds that Falco has been running | count | second |
falco.Hostname information | gauge | - |
falco.Event source information (e.g. syscall or plugin-based sources) | gauge | - |
falco.Overall CPU usage percentage of all running processes on the host system | gauge | - |
falco.Overall memory usage in bytes of all running processes on the host system | gauge | byte |
falco.Total number of CPUs on the host system | gauge | cpu |
falco.Total number of open file descriptors on the host system | gauge | file |
falco.Number of currently running processes on the host system (from /proc/stat) | gauge | process |
falco.Active memory allocation by jemalloc memory allocator | count | byte |
falco.Total allocated memory by jemalloc memory allocator | count | byte |
falco.Memory mapped by jemalloc memory allocator | count | byte |
falco.Memory used for jemalloc metadata | count | byte |
falco.Transparent huge page memory used for jemalloc metadata | count | byte |
falco.Resident memory held by jemalloc memory allocator | count | byte |
falco.Memory retained by jemalloc for future allocations | count | byte |
falco.Memory from zero-sized reallocations in jemalloc | count | byte |
falco.Kernel release version information | gauge | - |
falco.Proportional Set Size memory usage of the Falco process | gauge | byte |
falco.Resident Set Size memory usage of the Falco process | gauge | byte |
falco.Virtual Set Size memory usage of the Falco process | gauge | byte |
falco.Total number of events dropped from the output queue | count | - |
falco.Total number of rule matches detected by Falco security rules | count | - |
falco.SCAP engine information (e.g. bpf modern_bpf or kmod) | gauge | - |
falco.Total number of file descriptors added to the internal tracking tables | count | file |
falco.Total number of threads added to the internal tracking tables | count | thread |
falco.Total number of successful file descriptor lookups from cache | count | - |
falco.Total number of successful thread lookups from cache | count | - |
falco.Current number of containers being tracked | gauge | - |
falco.Total number of events dropped due to buffer issues | count | - |
falco.Total number of kernel-side event drops | count | - |
falco.Total number of events dropped due to full thread table | count | - |
falco.Total number of events dropped due to scratch map issues | count | - |
falco.Total number of events captured by the system call capture engine | count | - |
falco.Total number of failed file descriptor lookups | count | file |
falco.Total number of failed thread lookups | count | - |
falco.Current number of file descriptors stored in internal tables | gauge | file |
falco.Number of containers with missing or unknown container images | gauge | - |
falco.Total number of non-cached file descriptor lookups | count | file |
falco.Total number of non-cached thread lookups | count | - |
falco.Total number of file descriptors removed from internal tracking tables | count | file |
falco.Total number of threads removed from internal tracking tables | count | thread |
falco.Total number of events dropped during retrieval process | count | - |
falco.Total number of events successfully retrieved from kernel | count | - |
falco.Total number of events dropped during storage process | count | - |
falco.Total number of events successfully stored | count | - |
falco.Current number of threads stored in internal tracking tables | gauge | thread |
falco.SHA256 hash information of Falco configuration files | gauge | - |
falco.SHA256 hash information of Falco rules files | gauge | - |
公式ドキュメント
メトリクスの名前と説明は Datadog の公式インテグレーションの定義 (Copyright Datadog, Inc.・BSD-3-Clause) を英文のまま載せています。利用条件の全文は サイトについてにあります。