{"push_id":1225212454,"size":12,"distinct_size":12,"ref":"refs/heads/falco-engine","head":"9468ed556c5aa04c2c67e0c60aa2d15a72ce1935","before":"5e6e1fc6e52d7759769eb15dc96b9742cb63ef86","commits":[{"sha":"5670aa273eed8e1df69a622ed47f04e8db483e0b","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Get rid of TODO list.","distinct":true,"url":"https://api.github.com/repos/draios/falco/commits/5670aa273eed8e1df69a622ed47f04e8db483e0b"},{"sha":"cba0f7f01aecd5d09e08af3299c3936191cc676b","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Move falco engine to its own library.\n\nMove the c++ and lua code implementing falco engine/falco common to its\nown directory userspace/engine. It's compiled as a static library\nlibfalco_engine.a.\n\nThe lua code is split, so the two lua source\ndirectories (userspace/engine/lua and userspace/falco/lua) need to be\navailable separately via falco_common, so make it an argument to\nfalco_common::init.","distinct":true,"url":"https://api.github.com/repos/draios/falco/commits/cba0f7f01aecd5d09e08af3299c3936191cc676b"},{"sha":"0776d4d1c1bd32e2c11e5522c958925bc1fe26ba","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Make changes to get building with agent.\n\nAdd necessary includes to the engine CMakeLists.txt to get it building\nwhen included as a part of the agent build.\n\nA lot of this is overly messy and I want to clean it up. I'm just\nchecking this in as a checkpoint.","distinct":true,"url":"https://api.github.com/repos/draios/falco/commits/0776d4d1c1bd32e2c11e5522c958925bc1fe26ba"},{"sha":"6c4308ca1e2aca82c2c8ca3206911bd188db7faa","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Get rid of todo list.\n\nWe've made all the changes on the list.","distinct":true,"url":"https://api.github.com/repos/draios/falco/commits/6c4308ca1e2aca82c2c8ca3206911bd188db7faa"},{"sha":"43d335e1cc0b5548ac047370f52a16795ad9ea4e","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Better manage dependencies between falco/sinsp.\n\nCurrently, the dependency between falco and sinsp code was implicit,\nwhich casued problems when trying to link a program against both\nlibraries, as there's a circular dependency.\n\nFix this by making the dependency explicit (and\nconfigurable). FALCO_SINSP_LIBRARY is set by the CMakefile that includes\nthe falco_engine directory to the library containing sinsp code.\n\nBy making the dependency explicit, cmake can note the circular\ndependency and resolve everything appropriately.","distinct":true,"url":"https://api.github.com/repos/draios/falco/commits/43d335e1cc0b5548ac047370f52a16795ad9ea4e"},{"sha":"234f09f0e127e0703574f0ffcef7be6e4f8f7032","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Clean up cmake includes","distinct":true,"url":"https://api.github.com/repos/draios/falco/commits/234f09f0e127e0703574f0ffcef7be6e4f8f7032"},{"sha":"1c1f0609dcf18138bf57fb6767724c977692f11f","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Trim down include directories.\n\nWith changes related to the engine/outputs split, there's no need to\ninclude yamlcpp while building the engine any longer.","distinct":true,"url":"https://api.github.com/repos/draios/falco/commits/1c1f0609dcf18138bf57fb6767724c977692f11f"},{"sha":"d92a12a46799f9fefbab84245b4c1d00d0e01238","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Clean up LPEG build/defs.\n\nModify build-lpeg to add a PREFIX argument to allow for object\nfiles/libraries being in an alternate location.\n\nWhen building lpeg, put object files in a build/ subdirectory.\n\nUse LPEG_LIB instead of LPEG_SRC as the define for the lpeg library to\nbe consistent with other libraries.\n\nRemove duplicate LUAJIT_INCLUDE.","distinct":true,"url":"https://api.github.com/repos/draios/falco/commits/d92a12a46799f9fefbab84245b4c1d00d0e01238"},{"sha":"e1e5a93ed770361a5ccbf2e86c1099ce9152df5c","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Clean up lua file installation for falco engine.\n\nFix CMakefiles so it's possible to install falco engine both in\nstandalone product and agent. New variable FALCO_SHARE_DIR points to the\npath below the install prefix where the lua subdirectory should go. Set\nto share/falco for standalone product.\n\nSet CMAKE_INSTALL_PREFIX to /usr so both tarball and rpm/dpkg packages\ninstall everything under /usr. Currently, the tarball was installing\nunder /usr/local while the packages were installing under /usr.\n\nInstead of specifying /usr/share/falco in config_falco_*.h.in, use\nCMAKE_INSTALL_PREFIX and FALCO_SHARE_DIR.\n\nAdd an optional FALCO_COMPONENT that if set adds a COMPONENT argument to\nthe install command.","distinct":true,"url":"https://api.github.com/repos/draios/falco/commits/e1e5a93ed770361a5ccbf2e86c1099ce9152df5c"},{"sha":"e4b0d26fc0c12628f21129fa3106f04fde435d04","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Embed building rules into bulding engine.\n\nMove the add_subdirectory for the falco rules into the falco engine, so\nincluding the engine also builds the rules.\n\nMake it easier to have a configurable directory and component for the\nrules by using the variables FALCO_ETC_DIR and FALCO_COMPONENT.","distinct":true,"url":"https://api.github.com/repos/draios/falco/commits/e4b0d26fc0c12628f21129fa3106f04fde435d04"},{"sha":"cb6b4a849a79368ae5755c06a95555982a48449b","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Add configurable event dropping for falco engine.\n\nAdd the ability to drop events at the falco engine level in a way that\ncan scale with the dropping that already occurs at the kernel/inspector\nlevel.\n\nNew inline function should_drop_evt() controls whether or not events are\nmatched against the set of rules, and is controlled by two\nvalues--sampling ratio and sampling multiplier.\n\nHere's how the sampling ratio and multiplier influence whether or not an\nevent is dropped in should_drop_evt(). The intent is that\nm_sampling_ratio is generally changing external to the engine e.g. in\nthe main inspector class based on how busy the inspector is. A sampling\nratio implies no dropping. Values > 1 imply increasing levels of\ndropping. External to the engine, the sampling ratio results in events\nbeing dropped at the kernel/inspector interface.  The sampling\nmultiplier is an amplification to the sampling factor in\nm_sampling_ratio. If 0, no additional events are dropped other than\nthose that might be dropped by the kernel/inspector interface. If 1,\nevents that make it past the kernel module are subject to an additional\nlevel of dropping at the falco engine, scaling with the sampling ratio\nin m_sampling_ratio.\n\nUnlike the dropping that occurs at the kernel level, where the events in\nthe first part of each second are dropped, this dropping is random.","distinct":true,"url":"https://api.github.com/repos/draios/falco/commits/cb6b4a849a79368ae5755c06a95555982a48449b"},{"sha":"9468ed556c5aa04c2c67e0c60aa2d15a72ce1935","author":{"name":"Mark Stemm","email":"ee0738fd734a71825774e3bf64b7debc57eb46e5@sysdig.com"},"message":"Move back to falco directory.\n\nThis isn't used much but I don't want to completely lose it. Move it\nback to the falco directory so it doesn't get picked up when someone\nuses the falco engine library.","distinct":true,"url":"https://api.github.com/repos/draios/falco/commits/9468ed556c5aa04c2c67e0c60aa2d15a72ce1935"}]}
{"actor":{"display_login":"mstemm"}}