Issif
commented
7 months ago this is strange, I'll try to create fake data to reproduce the bug. thanks
Closed pentago closed 1 month ago
Issif
commented
7 months ago this is strange, I'll try to create fake data to reproduce the bug. thanks
Issif
commented
7 months ago OK, I found the problem, I need to work on the algorithm I implemented to aggregate the data in buckets. Don't know yet if I can improve it. I'm facing more and more issues with the Redis used as backend and I'm considering more and more to replace it. Will keep you updated anyway.
pentago
commented
7 months ago Amazing, thanks a ton!
poiana
commented
3 months ago Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
poiana
commented
2 months ago Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle rotten
poiana
commented
1 month ago Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Provide feedback via https://github.com/falcosecurity/community. /close
poiana
commented
1 month ago @poiana: Closing this issue.
Describe the bug
Graphs can show events with a future date. And it's changing depending on the "Since" period selected.
If I pick "1 month", the graph displays the event as it happened today. (not true) If I pick "1 year", the graph displays the event as it will happen on May 1. (not true)
The actual event occurred like a week ago.
Actual occurrence date:
How to reproduce it
Select a time range longer than 24 hours.
Expected behaviour
The graph should display the correct event time.
Environment
Falco version: Tue Apr 16 09:47:30 2024: Falco version: 0.37.1 (x86_64) Tue Apr 16 09:47:30 2024: Falco initialized with configuration file: /etc/falco/falco.yaml Tue Apr 16 09:47:30 2024: System info: Linux version 5.15.0-102-generic (buildd@lcy02-amd64-080) (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #112-Ubuntu SMP Tue Mar 5 16:50:32 UTC 2024 {"default_driver_version":"7.0.0+driver","driver_api_version":"8.0.0","driver_schema_version":"2.0.0","engine_version":"31","engine_version_semver":"0.31.0","falco_version":"0.37.1","libs_version":"0.14.3","plugin_api_version":"3.2.0"}
System info: Tue Apr 16 09:48:12 2024: Falco version: 0.37.1 (x86_64) Tue Apr 16 09:48:12 2024: Falco initialized with configuration file: /etc/falco/falco.yaml Tue Apr 16 09:48:12 2024: System info: Linux version 5.15.0-102-generic (buildd@lcy02-amd64-080) (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #112-Ubuntu SMP Tue Mar 5 16:50:32 UTC 2024 Tue Apr 16 09:48:12 2024: Loading plugin 'k8saudit' from file /usr/share/falco/plugins/libk8saudit.so Tue Apr 16 09:48:12 2024: Loading plugin 'json' from file /usr/share/falco/plugins/libjson.so Tue Apr 16 09:48:12 2024: Loading plugin 'k8smeta' from file /usr/share/falco/plugins/libk8smeta.so parse error: Invalid numeric literal at line 1, column 4 Tue Apr 16 09:48:12 2024: Loading rules from file /etc/falco/falco_rules.yaml Tue Apr 16 09:48:12 2024: Loading rules from file /etc/falco/falco-incubating_rules.yaml Tue Apr 16 09:48:12 2024: Loading rules from file /etc/falco/falco-sandbox_rules.yaml Tue Apr 16 09:48:12 2024: Loading rules from file /etc/falco/k8s_audit_rules.yaml Tue Apr 16 09:48:12 2024: Loading rules from file /etc/falco/rules.d/argocd-application-controller-allowed-secret-consuming_override.yaml Tue Apr 16 09:48:13 2024: Loading rules from file /etc/falco/rules.d/clear-dpkg-log_override.yaml Tue Apr 16 09:48:13 2024: Loading rules from file /etc/falco/rules.d/container-running-as-root-enabled_override.yaml Tue Apr 16 09:48:13 2024: Loading rules from file /etc/falco/rules.d/falco-daemonset-allowed-mounting-proc_override.yaml Tue Apr 16 09:48:13 2024: Loading rules from file /etc/falco/rules.d/falco-write-root-sigstore_override.yaml Tue Apr 16 09:48:13 2024: Loading rules from file /etc/falco/rules.d/fluentbit-exclude-container-running-as-root_override.yaml Tue Apr 16 09:48:13 2024: Loading rules from file /etc/falco/rules.d/k3s-cloud-controller-manager-add-to-allowed-users_override.yaml Tue Apr 16 09:48:13 2024: Loading rules from file /etc/falco/rules.d/k3s-supervisor-allowed-secret-consuming_override.yaml Tue Apr 16 09:48:14 2024: Loading rules from file /etc/falco/rules.d/kubernetes-dashboard-allowed-reading-secrets_override.yaml Tue Apr 16 09:48:14 2024: Loading rules from file /etc/falco/rules.d/local-path-provisioner-allowed-creating-sa-in-kube-system_override.yaml Tue Apr 16 09:48:14 2024: Loading rules from file /etc/falco/rules.d/metrics-server-allowed-creating-sa-in-kube-system_override.yaml Tue Apr 16 09:48:14 2024: Loading rules from file /etc/falco/rules.d/redis-write-temp-rdb_override.yaml Tue Apr 16 09:48:14 2024: Loading rules from file /etc/falco/rules.d/sealed-secrets-allowed-creating-sa-in-kube-system_override.yaml
Cloud provider or hardware configuration:
OS: PRETTY_NAME="Debian GNU/Linux 12 (bookworm)" NAME="Debian GNU/Linux" VERSION_ID="12" VERSION="12 (bookworm)" VERSION_CODENAME=bookworm ID=debian HOME_URL="https://www.debian.org/" SUPPORT_URL="https://www.debian.org/support" BUG_REPORT_URL="https://bugs.debian.org/"
Kernel: Linux falco-6dp4r 5.15.0-102-generic #112-Ubuntu SMP Tue Mar 5 16:50:32 UTC 2024 x86_64 GNU/Linux
Installation method: Kubernetes
Additional context N/A