Update Falco with event parsing fix - #3681
Open
Stringy wants to merge 1 commit into
Open
Conversation
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe ChangesFalco libraries update
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@collector/lib/system-inspector/Service.cpp`:
- Around line 130-136: Update the sinsp_exception handling in GetNext() so only
genuinely recoverable parse failures return nullptr for Run() to retry;
propagate fatal or invalid-state exceptions or reinitialize the capture instead.
Replace the unthrottled CLOG warning with CLOG_THROTTLED for repeated failures,
preserving the existing successful-event path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 50f110a2-060a-44bb-857d-5889c44504de
📒 Files selected for processing (2)
collector/lib/system-inspector/Service.cppfalcosecurity-libs
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #3681 +/- ##
=======================================
Coverage 27.43% 27.43%
=======================================
Files 94 94
Lines 5406 5406
Branches 2535 2535
=======================================
Hits 1483 1483
Misses 3198 3198
Partials 725 725
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
Updates the falcosecurity-libs submodule to include the lenient filename parameter extraction fix that prevents collector from crashing on malformed BPF probe data during execve event parsing.
Stringy
force-pushed
the
giles/fix-sinsp-event-parse-crash
branch
from
July 31, 2026 10:30
7219d7e to
701263d
Compare
Stringy
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Updates the falcosecurity-libs submodule to include the lenient filename parameter extraction fix.
stackrox/falcosecurity-libs#98
Checklist
Automated testing
If any of these don't apply, please comment below.
Testing Performed
CI shuold be enough. Fedora CoreOS x86 was crashing, so this is the priority.