Closed apsega closed 3 months ago
ei @apsega thank you for reporting! we will take a look ASAP!
This https://github.com/falcosecurity/libs/pull/1858 should be the cause of the failure! we will probably release it with Falco 0.38.0 by the end of the month!
Just a question, do you see this page fault sporadically or is this something that always happens?
@Andreagit97 occasionally, probably depends on that server load.
ok got it thank you!
I've seen that you have page faults ebpf programs enabled bpf_prog_182d4293644cc965_pf_kernel+
. Do you use page_fault
events in your rules? So something like evt.type= page_fault
I asked this because it is unusual to see page faults programs enabled, and probably these programs are generating a lot of events...
Sorry for the delay. Apparently we don't have any rules containing page_fault
. Thinking if it's not misconfiguration issue from my end.
This should be solved in Falco 0.38.0!
Describe the bug
After upgrading Falco from
0.36.2
to0.37.1
and switching driver fromebpf
tomodern_ebpf
, it causes physical server with higher load to crash.How to reproduce it
Random behaviour over time on more loaded physical servers.
Environment
Additional context
Crashdump:
Installation using official helm chart version
0.4.2
with the following values: