Enabling debugging logs | Включение логов для отладки |
Falco | Falco |
By default, the log level for | По умолчанию используется уровень логирования |
Falcosidekick | Falcosidekick |
By default, the debug logging for | По умолчанию отладочное логирование выключено в |
To enable debugging logging set the | Для включения отладочного логирования установите параметр |
yaml apiVersion: deckhouse.io/v1alpha1 kind: ModuleConfig metadata: name: runtime-audit-engine spec: enabled: true settings: debugLogging: true | yaml apiVersion: deckhouse.io/v1alpha1 kind: ModuleConfig metadata: name: runtime-audit-engine spec: enabled: true settings: debugLogging: true |
Viewing metrics | Просмотр метрик |
You can use the PromQL query | Для получения метрик можно использовать PromQL-запрос |
shell
kubectl -n d8-monitoring exec -it prometheus-main-0 prometheus – | shell
kubectl -n d8-monitoring exec -it prometheus-main-0 prometheus – |
We will add Grafana dashboard in the future for viewing metrics. | В будущем мы добавим Grafana dashboard для просмотра метрик. |
Emulating a Falco event | Эмуляция события Falco |
You can use the event-generator CLI utility to generate a Falco events. | Вы можете использовать утилиту event-generator для генерации событий Falco. |
|
|
Use the following command to run all events with the Pod in Kubernetes cluster: | Вы можете использовать следующую команду для запуска тестового набора событий в кластере Kubernetes: |
shell kubectl run falco-event-generator –image=falcosecurity/event-generator run | shell kubectl run falco-event-generator –image=falcosecurity/event-generator run |
If you need to implement an action, use this guide. | Если вам нужно реализовать действие, воспользуйтесь руководством. |
Emulating a Falcosidekick event | Эмуляция события Falcosidekick |
You can use the Falcosidekick | Вы можете использовать Falcosidekick |
|
|
shell kubectl -n d8-runtime-audit-engine get pods | shell kubectl -n d8-runtime-audit-engine get pods |
Example of the output: | Пример вывода: |
text NAME READY STATUS RESTARTS AGE runtime-audit-engine-4cpjc 4/4 Running 0 3d12h runtime-audit-engine-rn7nj 4/4 Running 0 3d12h | text NAME READY STATUS RESTARTS AGE runtime-audit-engine-4cpjc 4/4 Running 0 3d12h runtime-audit-engine-rn7nj 4/4 Running 0 3d12h |
|
|
shell export POD_IP=$(kubectl -n d8-runtime-audit-engine get pod runtime-audit-engine-4cpjc –template ‘{{.status.podIP}}’) | shell export POD_IP=$(kubectl -n d8-runtime-audit-engine get pod runtime-audit-engine-4cpjc –template ‘{{.status.podIP}}’) |
|
|
shell kubectl run curl –image=curlimages/curl curl -X POST -H “Content-Type: application/json” -H “Accept: application/json” $POD_IP:2801/test | shell kubectl run curl –image=curlimages/curl curl -X POST -H “Content-Type: application/json” -H “Accept: application/json” $POD_IP:2801/test |
|
|
shell
kubectl -n d8-monitoring exec -it prometheus-main-0 prometheus – | shell
kubectl -n d8-monitoring exec -it prometheus-main-0 prometheus – |
|
|
json { “metric”: { “name”: “falco_events”, “container”: “kube-rbac-proxy”, “instance”: “192.168.199.60:4212”, “job”: “runtime-audit-engine”, “node”: “dev-master-0”, “priority”: “Debug”, “rule”: “Test rule”, “tier”: “cluster” }, “value”: [ 1687150913.828, “2” ] } | json { “metric”: { “name”: “falco_events”, “container”: “kube-rbac-proxy”, “instance”: “192.168.199.60:4212”, “job”: “runtime-audit-engine”, “node”: “dev-master-0”, “priority”: “Debug”, “rule”: “Test rule”, “tier”: “cluster” }, “value”: [ 1687150913.828, “2” ] } |