search

falcosecurity / falcosidekick-ui

A simple WebUI with latest events from Falco
Apache License 2.0
112 stars 16 forks source link

FALCOSIDEKICK_UI_TTL #101

Closed mugambika closed 1 year ago

mugambika commented 1 year ago

What to document

I would like to understand what is FALCOSIDEKICK_UI_TTL used for. How does it help in Redis database not getting filled ? Does it consider the number of events or number of days ?

If there are a lot of events, how can I limit them by the number of days in UI?

Issif commented 1 year ago

This setting sets an expiration (in seconds) for the keys in the Redis database. This is basically this command: https://redis.io/commands/expire/

By setting a value different from zero, the keys will be purged when the ttl expires. For example, with FALCOSIDEKICK_UI_TTL=84600, the keys will disappear after 24h.

mugambika commented 1 year ago

Thank you for the clarification @Issif. Is there an upper limit for this value ? When I set it to ttl: 1209600, I see this error:

invalid value "1.2096e+06" for flag -t: parse error

Issif commented 1 year ago

It seems to be an issue with the parsing of flags. I'll take a look next week (not before Wednesday or Thursday)

Issif commented 1 year ago

I'm not able to replicate your issue:

❯ go run .  -t 1209600
2023/07/11 20:47:31 [INFO] : Falcosidekick UI is listening on 0.0.0.0:2802
2023/07/11 20:47:31 [INFO] : log level is info

I added a function to export the config and the TTL is correctly parsed and interpreted:

❯ go run .  -t 1209600
{"listen-address":"0.0.0.0","listen-port":2802,"redis-server":"localhost:6379","dev-mode":false,"disable-auth":false,"log-level":"info","ttl":1209600,"credentials":"admin:admin"}
2023/07/11 20:48:30 [INFO] : Falcosidekick UI is listening on 0.0.0.0:2802
2023/07/11 20:48:30 [INFO] : log level is info

Same with the env var.

Issif commented 1 year ago

FYI #108