search

cilium / tetragon

eBPF-based Security Observability and Runtime Enforcement
https://tetragon.io
Apache License 2.0
3.65k stars 369 forks source link

export: add an option to export events to tetragon container log #1710

Open michi-covalent opened 1 year ago

michi-covalent commented 1 year ago

right now tetragon only supports exporting events to json log file, and then have a separate container that tails the log and print them to stdout. add an option to export events directly to tetragon container logs. some people prefer not having to deal with mounting volumes, run a separate container and such.

Jack-R-lantern commented 1 year ago

@michi-covalent please assign me

mtardy commented 10 months ago

Hello @Jack-R-lantern, do you still plan to work on this?

christian-2 commented 9 months ago

I initially also thought that an --export-stdout could be useful, but have since arrived at a different (still preliminary) view: isn't it the case that his would mix both diagnostic output from Tetragon and its JSON events in its stdout? Splitting the two apart would presumably require a heuristic such as grep '^{', so why the burden? I also presume that quite often Tetragon and the consumers of its events run in different mount namespaces (e.g. different pods), whereas an --export-stdout would serve in more traditional (and perhaps rare) setups with single mount namespaces and Unix pipes. So not supporting it may be the cleaner solution.