Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow multiple filters #627

Merged
merged 2 commits into from
Jul 18, 2016
Merged

Allow multiple filters #627

merged 2 commits into from
Jul 18, 2016

Commits on Jul 14, 2016

  1. Whitespace diffs. 

    Putting whitespace changes in a separate commit.
    @mstemm
    mstemm committed Jul 14, 2016
    Configuration menu
    Copy the full SHA
    c15f0ff View commit details
    Browse the repository at this point in the history

  2. Add optional support for multiple filters. 

    Add support for an additional set of individual filters that can run
alongside the main filter set in sinsp::set_filter(). Each additional
filter comes with a list of event types for which the filter should run.

sinsp::add_evttype_filter adds an event type filter to the inspector. It
provides a list of event types and a sinsp_filter pointer. The list of
event types can be empty, implying the filter is a catchall filter and
should run for all event types. This does not replace the main function
set_filter()--the idea is that you can specify a global filter as well
as per-event type filters. Both will run for all events.

An array m_filter_by_evttype maps from event type to a list of
sinsp_filter pointers. Each list at index i holds the filters that
should run for events with type i. A filter can run for multiple event
types, so the sinsp_filter pointers can appear in multiple lists.

There's a separate list m_catchall_evttype_filters that contains filters
that should run for all event types.

The individual filter pointers are also held in a list m_evttype_filters
so they can be cleaned up on close().

A new method run_filters_on_evt() handles the details of running the
main filter, catchall filters, and the individual filters. It finds the
filters related to the event's type, and runs those filters.

Falco uses the lua callbacks in lua_parser{_api} to populate filters as
the lua code parses the rule's condition, so also modify lua_parser to
add a optional flag to get_parser that steals the m_filter object and
creates a new one. Falco calls get_parser for each rule's condition,
which allows it to create a sinsp_filter object for each rule.
    @mstemm
    mstemm committed Jul 14, 2016
    Configuration menu
    Copy the full SHA
    b3ebbe1 View commit details
    Browse the repository at this point in the history