Conversation
Add continuous file watching capability for audit logs using the tail:// URL scheme. This allows monitoring files for new entries and handles log rotation via inode detection and file truncation. Closes falcosecurity#191 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> Signed-off-by: Richard Tweed <RichardoC@users.noreply.github.com>
Add documentation for the new tail:// URL scheme and watchPollIntervalMs configuration option. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> Signed-off-by: Richard Tweed <RichardoC@users.noreply.github.com>
Signed-off-by: Richard Tweed <RichardoC@users.noreply.github.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: RichardoC The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
RichardoC
changed the title
Rules files suggestionsrulesComparing No changes detected |
irozzo-1A
left a comment
irozzo-1A
left a comment
There was a problem hiding this comment.
Hi @RichardoC, thanks for your contribution. I suggest using file instead of tail to have a more standard URI, and using an event based approach instead of polling.
Co-authored-by: Iacopo Rozzo <iacopo@sysdig.com> Signed-off-by: Richard Tweed <RichardoC@users.noreply.github.com>
Thank you for the thorough review @irozzo-1A , making those changes now |
|
Claude log for the changes |
Replace polling-based file watching with fsnotify for better efficiency. - Use fsnotify to watch parent directory (per maintainer recommendation) - Rename scheme from tail:// to file:// - Remove watchPollIntervalMs config (no longer needed) - Rename test package from tail to filewatch Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> Signed-off-by: Richard Tweed <RichardoC@users.noreply.github.com>
RichardoC
force-pushed
the
feature/k8saudit-file-watching
branch
from
0613d65 to
c12e1e0
Compare
|
The cargo install issue in ci seems unrelated to my changes |
Move tests from orphaned filewatch/ package into k8saudit alongside the code they test, and restore truncation detection that was lost in the fsnotify refactor. - Detect file truncation via size check before seeking (copytruncate) - Move filewatch/filewatch_test.go to watch_test.go in k8saudit package - Restore TestOpenFileWatch_HandlesTruncation test - Remove empty filewatch/ directory - Mark fsnotify as direct dependency in go.mod Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Richard Tweed <RichardoC@users.noreply.github.com>
Rules files suggestionsrulesComparing No changes detected |
…tcher - Align scanner buffer with MaxEventSize to avoid silently dropping large events - Log scanner errors instead of swallowing them - Log fsnotify watcher errors instead of discarding them - Add real assertions to watch tests using sentinel-based content verification Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Richard Tweed <RichardoC@users.noreply.github.com>
Rules files suggestionsrulesComparing No changes detected |
… trailing newline bufio.ScanLines returns the last non-empty line even without a trailing newline, but the offset tracking unconditionally added +1 for the delimiter. This caused the watcher to seek one byte past the actual end of content, skipping the first byte of subsequently appended data. Replace the manual offset arithmetic with file.Seek(0, io.SeekCurrent) after the scan loop to read the file descriptor's actual position, which is always exact regardless of trailing newlines. Also switch from scanner.Text() to scanner.Bytes() to avoid an unnecessary string allocation per line. Additionally fix a pre-existing build failure in extract_test.go caused by missing methods in the sdk.ExtractRequest interface stub. - edited by Opus 4.6 via cursor Signed-off-by: Richard Tweed <RichardoC@users.noreply.github.com>
RichardoC
force-pushed
the
feature/k8saudit-file-watching
branch
from
68ef8be to
7715826
Compare
4 participants
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
/area plugins
What this PR does / why we need it:
Add continuous file watching capability for audit logs using the
tail:// URL scheme. This allows monitoring files for new entries
and handles log rotation via inode detection and file truncation.
Which issue(s) this PR fixes:
Fixes #191
Special notes for your reviewer: Generated with Claude Code. Full transcript attached
claude-log.txt