From f72e6a59ad0bb3b7f1df52cf3e4e37e1b8d2a615 Mon Sep 17 00:00:00 2001 From: Federico Di Pierro Date: Mon, 7 Oct 2024 09:28:06 +0200 Subject: [PATCH] fix(userspace/falco): fix event set selection for plugin with parsing capability. In live mode we need to use the source_info inspectors instead of the offline inspector. Signed-off-by: Federico Di Pierro --- .../actions/configure_interesting_sets.cpp | 24 +++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/userspace/falco/app/actions/configure_interesting_sets.cpp b/userspace/falco/app/actions/configure_interesting_sets.cpp index 914073007b9..86f2b894867 100644 --- a/userspace/falco/app/actions/configure_interesting_sets.cpp +++ b/userspace/falco/app/actions/configure_interesting_sets.cpp @@ -78,11 +78,27 @@ static void select_event_set(falco::app::state& s, /* Load PPM event codes needed by plugins with parsing capability */ libsinsp::events::set plugin_ev_codes; - for(const auto& p : s.offline_inspector->get_plugin_manager()->plugins()) { - if(!(p->caps() & CAP_PARSING)) { - continue; + if(s.is_capture_mode()) { + // In capture mode, we need to use the offline inspector + // because plugins are inited under it; see init_inspectors action. + for(const auto& p : s.offline_inspector->get_plugin_manager()->plugins()) { + if(!(p->caps() & CAP_PARSING)) { + continue; + } + plugin_ev_codes.merge(p->parse_event_codes()); + } + } else { + // In live mode, we need to use inspectors from the loaded sources, + // because plugins are inited under them; see init_inspectors action. + for(const auto& src : s.loaded_sources) { + auto src_info = s.source_infos.at(src); + for(const auto& p : src_info->inspector->get_plugin_manager()->plugins()) { + if(!(p->caps() & CAP_PARSING)) { + continue; + } + plugin_ev_codes.merge(p->parse_event_codes()); + } } - plugin_ev_codes.merge(p->parse_event_codes()); } const auto plugin_sc_set = libsinsp::events::event_set_to_sc_set(plugin_ev_codes); const auto plugin_names = libsinsp::events::sc_set_to_event_names(plugin_sc_set);