1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
/*
Copyright (C) 2021 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <fstream>
#include <sinsp.h>
#include <user_event.h>
#include <logger.h>
#include "user_event_logger.h"
#include "json_error_log.h"
json_error_log g_json_error_log;
json_error_log::json_error_log()
: m_events_rate(.00333), // one event per 5 minutes
m_events_max_burst(10)
{
}
json_error_log::~json_error_log()
{
}
void json_error_log::set_json_parse_errors_file(const std::string& filename)
{
m_json_parse_errors_file = filename;
}
// Note: not changing the rate/burst of any already-created bucket
void json_error_log::set_events_rate(double events_rate, uint32_t max_burst)
{
m_events_rate = events_rate;
m_events_max_burst = max_burst;
}
void json_error_log::log(const std::string &json, const std::string &errstr,
uint64_t ts_ns, const std::string &uri)
{
time_t now = ts_ns / ONE_SECOND_IN_NS;
if(m_json_parse_errors_file != "")
{
std::ofstream errs(m_json_parse_errors_file, std::ofstream::out | std::ofstream::app);
char buf[sizeof("YYYY-MM-DDTHH:MM:SSZ")];
strftime(buf, sizeof(buf), "%FT%TZ", gmtime(&now));
errs << "*******************************" << std::endl;
errs << "URI: " << uri << std::endl;
errs << "Time (UTC): " << buf << std::endl;
errs << "Error: " << errstr << std::endl;
errs << "Json: " << json << std::endl;
errs << "*******************************" << std::endl;
errs.close();
}
token_bucket &bucket = get_bucket(uri);
if(bucket.claim(1, ts_ns))
{
sinsp_user_event::tag_map_t tags;
tags["source"] = "json_parser";
tags["uri"] = uri;
tags["json_prefix"] = json.substr(0, 100);
std::string event_name = "json_parse_error";
std::string desc = errstr;
event_scope scope;
if(m_machine_id.length())
{
scope.add("host.mac", m_machine_id);
}
// Also emit a custom event noting the json parse failure.
auto evt = sinsp_user_event(now,
std::move(event_name),
std::move(desc),
std::move(scope.get_ref()),
std::move(tags),
user_event_logger::SEV_EVT_WARNING);
g_logger.log("Logging user event: " + evt.to_string(), sinsp_logger::SEV_DEBUG);
user_event_logger::log(evt, user_event_logger::SEV_EVT_WARNING);
}
}
token_bucket &json_error_log::get_bucket(const std::string &uri)
{
auto it = m_buckets.lower_bound(uri);
if(it == m_buckets.end() ||
it->first != uri)
{
it = m_buckets.emplace_hint(it,
std::make_pair(uri, token_bucket()));
it->second.init(m_events_rate, m_events_max_burst);
}
return it->second;
}
|
