mlavacca / falco-tracing-framework Goto Github PK

Student: Mattia Lavacca
Org: CNCF
Mentors: Loris Degioanni, Leonardo Di Donato, Michael Ducy, Lorenzo Fontana

The whole repository, alongside the tracing branches of Falco and Sysdig, is the outcome of a GSOC project. The following parts of this issue are a summarization of my GSOC experience.

What work was done

• Falco-plugin: a library written in C++ that, once compiled with Falco and Sysdig, allows them to use tracing functions that can be used to insert custom tracepoint;
• Creation of a new branch of Falco that have been modified in order to allow Falco stack traces gathering (diff file);
• Creation of a new branch of Sysdig that have been modified in order to allow Sysdig rules metrics gathering(diff file);
• Falco-tracer: a metrics aggregator program (written in go) that gets all the metrics produced by Falco, formats them in various ways (custom .json, .dot, .folded) and writes them on file.
• Rules-plotter: a python program that allows plotting rules metrics.
• By using the software described above, I performed many tracing tests in order to discover the bottlenecks of Falco. Here is the outcome of those tests.

What's left to do

• To study deeper what are the performance constraints that the Falco rules elaboration brings in to Falco.
• To improve Falco performance by solving the critical parts of Falco (in terms of performance constraints).
• To include a test framework in falco-tracer for allowing to test the rules matchings.
• To plug the falco-tracer tool to the CI/CD.

Learnings

This GSOC has made me learn a lot about different topics:

• learned go language that I used to develop the falco-tracer;
• Improved my skills of code analysis and debugging;
• Improved my knowledge about the Linux kernel;
• Improved my understanding about the build of large software, by means of CMake;
• Learned a lot about the devOps world and the tools used in that environment;
• Learned the importance of communication while working in a team;

Conclusions

I'm very pleased with these past three months, I learned a lot of things and I became more familiar with the open-source world. I will continue to contribute to open source for sure. A special thanks to my mentors that helped me a lot.