diff --git a/docs/content/en/docs/reference/metrics.md b/docs/content/en/docs/reference/metrics.md index 78582dbc06e..d1d4be2147c 100644 --- a/docs/content/en/docs/reference/metrics.md +++ b/docs/content/en/docs/reference/metrics.md @@ -170,6 +170,10 @@ The total number of times we encounter a given message opcode. For internal use The total number of events dropped because listener buffer was full +### `tetragon_policyfilter_hook_container_name_missing_total` + +The total number of operations when the container name was missing in the OCI hook + ### `tetragon_policyfilter_metrics_total` Policy filter metrics. For internal use only. diff --git a/pkg/metrics/policyfiltermetrics/policyfiltermetrics.go b/pkg/metrics/policyfiltermetrics/policyfiltermetrics.go index 07c0f43fe1b..0c60cf844e9 100644 --- a/pkg/metrics/policyfiltermetrics/policyfiltermetrics.go +++ b/pkg/metrics/policyfiltermetrics/policyfiltermetrics.go @@ -71,8 +71,17 @@ var ( }, []string{"subsys", "op", "error"}) ) +var ( + PolicyFilterHookContainerNameMissingMetrics = prometheus.NewCounter(prometheus.CounterOpts{ + Namespace: consts.MetricsNamespace, + Name: "policyfilter_hook_container_name_missing_total", + Help: "The total number of operations when the container name was missing in the OCI hook", + ConstLabels: nil, + }) +) + func InitMetrics(registry *prometheus.Registry) { - registry.MustRegister(PolicyFilterOpMetrics) + registry.MustRegister(PolicyFilterOpMetrics, PolicyFilterHookContainerNameMissingMetrics) // Initialize metrics with labels for _, subsys := range subsysLabelValues { @@ -93,3 +102,7 @@ func InitMetrics(registry *prometheus.Registry) { func OpInc(subsys Subsys, op Operation, err string) { PolicyFilterOpMetrics.WithLabelValues(subsys.String(), op.String(), err).Inc() } + +func ContNameMissInc() { + PolicyFilterHookContainerNameMissingMetrics.Inc() +} diff --git a/pkg/policyfilter/rthooks/rthooks.go b/pkg/policyfilter/rthooks/rthooks.go index 325d2d6c970..4a91b79151e 100644 --- a/pkg/policyfilter/rthooks/rthooks.go +++ b/pkg/policyfilter/rthooks/rthooks.go @@ -97,6 +97,7 @@ func createContainerHook(_ context.Context, arg *rthooks.CreateContainerArg) err containerName := arg.Req.ContainerName if containerName == "" { log.Warnf("failed to find container information for %s, but will continue", containerID) + policyfiltermetrics.ContNameMissInc() } log.WithFields(logrus.Fields{ @@ -107,10 +108,13 @@ func createContainerHook(_ context.Context, arg *rthooks.CreateContainerArg) err "container-name": containerName, }).Trace("policyfilter: add pod container") cgid := policyfilter.CgroupID(cgID) - if err := pfState.AddPodContainer(policyfilter.PodID(podID), namespace, pod.Labels, containerID, cgid, containerName); err != nil { + err = pfState.AddPodContainer(policyfilter.PodID(podID), namespace, pod.Labels, containerID, cgid, containerName) + policyfiltermetrics.OpInc(policyfiltermetrics.RTHooksSubsys, policyfiltermetrics.AddContainerOperation, policyfilter.ErrorLabel(err)) + + if err != nil { log.WithError(err).Warn("failed to update policy filter, aborting hook.") + return err } - policyfiltermetrics.OpInc(policyfiltermetrics.RTHooksSubsys, policyfiltermetrics.AddContainerOperation, policyfilter.ErrorLabel(err)) return nil }