File: json_error_log.h

package info (click to toggle)
falcosecurity-libs 0.1.1dev%2Bgit20220316.e5c53d64-5.1
  • links: PTS, VCS
  • area: main
  • in suites: bookworm
  • size: 4,732 kB
  • sloc: cpp: 55,770; ansic: 37,330; makefile: 74; sh: 13
file content (65 lines) | stat: -rw-r--r-- 1,773 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
/*
Copyright (C) 2021 The Falco Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

*/
#pragma once

#include <string>
#include <map>

#include "token_bucket.h"

class json_error_log
{
public:

	json_error_log();
	virtual ~json_error_log();

	// Upon any json parsing error, write the error and json
	// document that had the error to this file. Not enabled by
	// default.
	void set_json_parse_errors_file(const std::string& filename);

	void set_events_rate(double events_rate, uint32_t max_burst);

	// Possibly log a json parsing error, depending on whether or
	// not the above filename was set.
	void log(const std::string &json, const std::string &errstr, uint64_t ts_ns, const std::string &uri);

	void set_machine_id(const std::string& machine_id);

private:

	// Return a token bucket limiting errors related to the
	// configured uri, creating it if necessary.
	token_bucket &get_bucket(const std::string &uri);

	std::string m_json_parse_errors_file;
	std::string m_machine_id;
	double m_events_rate;
	uint32_t m_events_max_burst;

	// Rate-limit json parse error events by uri.
	std::map<std::string,token_bucket> m_buckets;
};

inline void json_error_log::set_machine_id(const std::string& machine_id)
{
	m_machine_id = machine_id;
}

extern json_error_log g_json_error_log;