Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Alertmanager output priority label was replaced with event source #339

Closed
tks98 opened this issue Jun 29, 2022 · 2 comments · Fixed by #340
Closed

Alertmanager output priority label was replaced with event source #339

tks98 opened this issue Jun 29, 2022 · 2 comments · Fixed by #340
Labels
kind/bug Something isn't working
Milestone
2.27.0

Comments

@tks98
Copy link
Contributor

tks98 commented Jun 29, 2022

Describe the bug

#276 added the falco rule priority label to alertmanager alerts. However, it was replaced with "eventsource" in this commit: df701e0#diff-ba11f068a20574b892b9d687c40fc35d0ae2573b1dada7fc3cdb50afe3bd0b8f

In the other outputs, eventsource was added to the payload labels and priority was not removed. Ex: df701e0#diff-5a4930294ccf8c7a8f5dd94a095195a167bf5af6e74a2081f99df89e70758c80

To me this looks like the priority label was accidentally removed when the eventsource label was added for alertmanager. As when I view my falco alerts in alertmanager, eventsource does not tell me anything about the priority of the alert (seen in the attached screenshot)

I opened a corresponding PR to add back the priority label for Alertmanager and updated the test

How to reproduce it

Use falcosidekick 2.25+ and the alertmanager output

Expected behaviour

The alert priority should be exported along with the event source.

Screenshots

Priority label not present running sidekick 2.26.0
Screen Shot 2022-06-29 at 1 18 49 PM (1)

Environment

  • Falco version:
    Falco version: 0.31.0
    Driver version: 319368f1ad778691164d33d59945e00c5752cd27

  • System info:
    "machine": "x86_64",
    "nodename": "",
    "release": "4.18.0-372.9.1.el8.x86_64",
    "sysname": "Linux",
    "version": "fix: install ca-certificates #1 SMP Tue May 10 14:48:47 UTC 2022"

  • Cloud provider or hardware configuration:

  • OS:
    Rocky Linux 8.6 (Green Obsidian)
    PRETTY_NAME="Debian GNU/Linux 10 (buster)"
    NAME="Debian GNU/Linux"
    VERSION_ID="10"
    VERSION="10 (buster)"
    VERSION_CODENAME=buster
    ID=debian
    HOME_URL="https://www.debian.org/"
    SUPPORT_URL="https://www.debian.org/support"
    BUG_REPORT_URL="https://bugs.debian.org/"

  • Kernel:
    Linux 4.18.0-372.9.1.el8.x86_64 SMP Tue May 10 14:48:47 UTC 2022 x86_64 GNU/Linux

  • Installation method:
    Kubernetes via ebpf probe
@tks98 tks98 added the kind/bug Something isn't working label Jun 29, 2022
@tks98 tks98 mentioned this issue Jun 29, 2022
Merged
@Issif
Copy link
Member

Issif commented Jun 29, 2022

🤦‍♂️ Sorry for that. Thanks for your PR

@Issif Issif added this to the 2.27.0 milestone Jun 29, 2022
@tks98
Copy link
Contributor Author

tks98 commented Jun 29, 2022

🤦‍♂️ Sorry for that. Thanks for your PR

No problem at all, thanks for the quick response!

@Issif Issif moved this to Done in Falcosidekick 2.x Aug 25, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind/bug Something isn't working
Projects
Falcosidekick 2.x
Status: Done
Milestone
2.27.0
Development

Successfully merging a pull request may close this issue.

Adding back priority label for Alertmanager outputs tks98/falcosidekick
2 participants
@Issif @tks98