name=<NA> pid=-1 Unable to collect proc.name and proc.pid, etc.

[ox01024]

21:04:17.936567615: Warning (evt_type=page_fault name=<NA> pid=-1 tid=32024 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936566121: Warning (evt_type=ppoll name=<NA> pid=-1 tid=32024 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936568724: Warning (evt_type=ioctl name=<NA> pid=-1 tid=336 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936569197: Warning (evt_type=ppoll name=<NA> pid=-1 tid=32024 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936569578: Warning (evt_type=ioctl name=<NA> pid=-1 tid=336 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936570097: Warning (evt_type=rt_sigprocmask name=<NA> pid=-1 tid=32024 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936570269: Warning (evt_type=switch name=<NA> pid=-1 tid=818 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936570324: Warning (evt_type=rt_sigprocmask name=<NA> pid=-1 tid=32024 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936570685: Warning (evt_type=recvmsg name=<NA> pid=-1 tid=336 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936571374: Warning (evt_type=futex name=<NA> pid=-1 tid=7495 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936572862: Warning (evt_type=futex name=<NA> pid=-1 tid=7495 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936573214: Warning (evt_type=rt_sigprocmask name=<NA> pid=-1 tid=32024 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936573335: Warning (evt_type=futex name=<NA> pid=-1 tid=7495 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936573424: Warning (evt_type=rt_sigprocmask name=<NA> pid=-1 tid=32024 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936574579: Warning (evt_type=page_fault name=<NA> pid=-1 tid=32024 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936575098: Warning (evt_type=page_fault name=<NA> pid=-1 tid=32024 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936574142: Warning (evt_type=ppoll name=<NA> pid=-1 tid=32024 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936576150: Warning (evt_type=page_fault name=<NA> pid=-1 tid=336 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936577013: Warning (evt_type=page_fault name=<NA> pid=-1 tid=336 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936574738: Warning (evt_type=recvmsg name=<NA> pid=-1 tid=336 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936577544: Warning (evt_type=switch name=<NA> pid=-1 tid=32024 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936581440: Warning (evt_type=sendmsg name=<NA> pid=-1 tid=336 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936589245: Warning (evt_type=sendmsg name=<NA> pid=-1 tid=336 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936590776: Warning (evt_type=switch name=<NA> pid=-1 tid=336 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936592159: Warning (evt_type=poll name=<NA> pid=-1 tid=816 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936592335: Warning (evt_type=futex name=<NA> pid=-1 tid=7495 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936594368: Warning (evt_type=recvmsg name=<NA> pid=-1 tid=816 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936594525: Warning (evt_type=switch name=<NA> pid=-1 tid=7495 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936596330: Warning (evt_type=recvmsg name=<NA> pid=-1 tid=816 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936601814: Warning (evt_type=futex name=<NA> pid=-1 tid=816 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936607360: Warning (evt_type=switch name=<NA> pid=-1 tid=7494 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936615481: Warning (evt_type=futex name=<NA> pid=-1 tid=816 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936617043: Warning (evt_type=poll name=<NA> pid=-1 tid=816 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936620105: Warning (evt_type=switch name=<NA> pid=-1 tid=816 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936628825: Warning (evt_type=access name=<NA> pid=-1 tid=336 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)
21:04:17.936633291: Warning (evt_type=access name=<NA> pid=-1 tid=336 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 exe_flags=<NA>)

Linux ubuntu22 6.5.0-28-generic #29~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr 4 14:39:20 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

root@ubuntu22:~# docker info
Client:
Version: 24.0.5
Context: default
Debug Mode: false

Server:
Containers: 48
Running: 0
Paused: 0
Stopped: 48
Images: 12
Server Version: 24.0.5
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: false
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version:
runc version:
init version:
Security Options:
apparmor
seccomp
Profile: builtin
cgroupns
Kernel Version: 6.5.0-28-generic
Operating System: Ubuntu 22.04.4 LTS
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 7.712GiB
Name: ubuntu22
ID: f6a2ad8b-6601-48e8-8d90-fef119a4aa17
Docker Root Dir: /var/lib/docker
Debug Mode: false
Experimental: false
Insecure Registries:
registry.ahcloud-private.com:5000
registry.storm.io
10.50.26.198:80
127.0.0.0/8
Live Restore Enabled: false

root@ubuntu22:~# kubectl version
Client Version: version.Info{Major:"1", Minor:"22", GitVersion:"v1.22.12", GitCommit:"b058e1760c79f46a834ba59bd7a3486ecf28237d", GitTreeState:"clean", BuildDate:"2022-07-13T14:59:18Z", GoVersion:"go1.16.15", Compiler:"gc", Platform:"linux/amd64"}

On Ubuntu deployed with docker + k8s, using Falco version greater than 0.36.1 (estimated), the default configuration does not collect process information such as proc.pid and proc.name.

Mitigation Measures Guidance

• Falco version:
  Tue Jun 4 21:29:15 2024: Falco version: 0.38.0 (x86_64)
  Tue Jun 4 21:29:15 2024: Falco initialized with configuration files:
  Tue Jun 4 21:29:15 2024: /etc/falco/falco.yaml
  Tue Jun 4 21:29:15 2024: System info: Linux version 6.5.0-28-generic (buildd@lcy02-amd64-098) (x86_64-linux-gnu-gcc-12 (Ubuntu 12.3.0-1ubuntu122.04) 12.3.0, GNU ld (GNU Binutils for Ubuntu) 2.38) Add install-digwatch script template #2922.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr 4 14:39:20 UTC 2
  Falco version: 0.38.0
  Libs version: 0.17.1
  Plugin API: 3.5.0
  Engine: 0.40.0
  Driver:
  API version: 8.0.0
  Schema version: 2.0.0
  Default driver: 7.2.0+driver
• System info:

root@ubuntu22:# falco --support | jq .system_info
Tue Jun 4 21:29:31 2024: Falco version: 0.38.0 (x86_64)
Tue Jun 4 21:29:31 2024: Falco initialized with configuration files:
Tue Jun 4 21:29:31 2024: /etc/falco/falco.yaml
Tue Jun 4 21:29:31 2024: System info: Linux version 6.5.0-28-generic (buildd@lcy02-amd64-098) (x86_64-linux-gnu-gcc-12 (Ubuntu 12.3.0-1ubuntu122.04) 12.3.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #2922.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr 4 14:39:20 UTC 2
Tue Jun 4 21:29:31 2024: Loading rules from file /etc/falco/falco_rules.yaml
Tue Jun 4 21:29:31 2024: Loading rules from file /etc/falco/falco_rules.local.yaml
{
"machine": "x86_64",
"nodename": "ubuntu22",
"release": "6.5.0-28-generic",
"sysname": "Linux",
"version": "#2922.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr 4 14:39:20 UTC 2"
}

• Kernel:
  PRETTY_NAME="Ubuntu 22.04.4 LTS"
  NAME="Ubuntu"
  VERSION_ID="22.04"
  VERSION="22.04.4 LTS (Jammy Jellyfish)"
  VERSION_CODENAME=jammy
  ID=ubuntu
  ID_LIKE=debian
  HOME_URL="https://www.ubuntu.com/"
  SUPPORT_URL="https://help.ubuntu.com/"
  BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
  PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
  UBUNTU_CODENAME=jammy

• Installation method: Linux ubuntu22 6.5.0-28-generic Add install-digwatch script template #29~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr 4 14:39:20 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Kubernetes

[Andreagit97]

Ei @ ox01024 a possible cause here is that you are catching all possible events generated by Falco and so you are facing many drops.

This is just a guess but looking at your logs I see events like evt_type=page_fault or evt_type=switch that should always be disabled unless you really need them.

If you just use Falco with the default configuration and default ruleset they should be disabled by default... you can check what you are enabling with -o log_level=debug so something like

sudo ./usr/bin/falco -c ./etc/falco/falco.yaml -r ./etc/falco/falco_rules.yaml  -o engine.kind=modern_ebpf -o log_level=debug

[ox01024]

Thank you for your enthusiastic response. I will continue to investigate the issue based on the plan you provided. If the situation stabilizes, I will update the progress in a timely manner to help more friends who encounter similar problems.

[ox01024]

@Andreagit97
Page Error and Switch events seem to be caused by my strategy being too broad. Now I am using a narrower range of test rules.

It is like this.

- rule: Test
  desc: >
    Test
  condition: >
    evt.type=recvmsg
  enabled: true
  output: Test  ( pid=%proc.pid connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty %container.info)
  priority: WARNING
  tags: [maturity_deprecated, host, container, network, mitre_lateral_movement, T1021.004]

However, the results remain the same, so it should not be a problem caused by these events.

root@ubuntu:~# falco -c /etc/falco/falco.yaml -r test.yaml  -o engine.kind=modern_ebpf -o log_level=debug 
Tue Jun 11 09:23:00 2024: Falco version: 0.38.0 (x86_64)
Tue Jun 11 09:23:00 2024: CLI args: falco -c /etc/falco/falco.yaml -r test.yaml -o engine.kind=modern_ebpf -o log_level=debug
Tue Jun 11 09:23:00 2024: Falco initialized with configuration files:
Tue Jun 11 09:23:00 2024:    /etc/falco/falco.yaml
Tue Jun 11 09:23:00 2024: System info: Linux version 5.15.0-97-generic (buildd@lcy02-amd64-033) (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #107-Ubuntu SMP Wed Feb 7 13:26:48 UTC 2024
Tue Jun 11 09:23:00 2024: Configured rules filenames:
Tue Jun 11 09:23:00 2024:    test.yaml
Tue Jun 11 09:23:00 2024: Loading rules from file test.yaml
Tue Jun 11 09:23:00 2024: Watching file '/etc/falco/falco.yaml'
Tue Jun 11 09:23:00 2024: Watching file 'test.yaml'
Tue Jun 11 09:23:00 2024: Watching directory '/etc/falco/config.d'
Tue Jun 11 09:23:00 2024: (1) syscalls in rules: recvmsg
Tue Jun 11 09:23:00 2024: +(60) syscalls (Falco's state engine set of syscalls): accept, accept4, bind, capset, chdir, chroot, clone, clone3, close, connect, creat, dup, dup2, dup3, epoll_create, epoll_create1, eventfd, eventfd2, execve, execveat, fchdir, fcntl, fork, getsockopt, inotify_init, inotify_init1, io_uring_setup, memfd_create, mount, open, open_by_handle_at, openat, openat2, pidfd_getfd, pidfd_open, pipe, pipe2, prctl, prlimit, procexit, recvfrom, sendmsg, sendto, setgid, setpgid, setresgid, setresuid, setrlimit, setsid, setuid, shutdown, signalfd, signalfd4, socket, socketpair, timerfd_create, umount, umount2, userfaultfd, vfork
Tue Jun 11 09:23:00 2024: (61) syscalls selected in total (final set): accept, accept4, bind, capset, chdir, chroot, clone, clone3, close, connect, creat, dup, dup2, dup3, epoll_create, epoll_create1, eventfd, eventfd2, execve, execveat, fchdir, fcntl, fork, getsockopt, inotify_init, inotify_init1, io_uring_setup, memfd_create, mount, open, open_by_handle_at, openat, openat2, pidfd_getfd, pidfd_open, pipe, pipe2, prctl, prlimit, procexit, recvfrom, recvmsg, sendmsg, sendto, setgid, setpgid, setresgid, setresuid, setrlimit, setsid, setuid, shutdown, signalfd, signalfd4, socket, socketpair, timerfd_create, umount, umount2, userfaultfd, vfork
Tue Jun 11 09:23:00 2024: The chosen syscall buffer dimension is: 8388608 bytes (8 MBs)
Tue Jun 11 09:23:00 2024: Starting health webserver with threadiness 4, listening on 0.0.0.0:8765
Tue Jun 11 09:23:00 2024: Enabled rules:
Tue Jun 11 09:23:00 2024:    Test
Tue Jun 11 09:23:00 2024: (1) enabled rules in total
Tue Jun 11 09:23:00 2024: Setting metrics interval to 15m, equivalent to 900000 (ms)
Tue Jun 11 09:23:00 2024: Loaded event sources: syscall
Tue Jun 11 09:23:00 2024: Enabled event sources: syscall
Tue Jun 11 09:23:00 2024: Opening event source 'syscall'
Tue Jun 11 09:23:00 2024: Opening 'syscall' source with modern BPF probe.
Tue Jun 11 09:23:00 2024: One ring buffer every '2' CPUs.
{"hostname":"ubuntu","output":"09:23:02.374767433: Warning Test  ( pid=-1 connection=<NA> lport=<NA> rport=<NA> fd_type=<NA> fd_proto=fd.l4proto evt_type=recvmsg user=<NA> user_uid=4294967295 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 container_id= container_name=<NA>)","priority":"Warning","rule":"Test","source":"syscall","tags":["T1021.004","container","host","maturity_deprecated","mitre_lateral_movement","network"],"time":"2024-06-11T01:23:02.374767433Z", "output_fields": {"container.id":"","container.name":null,"evt.time":1718068982374767433,"evt.type":"recvmsg","fd.lport":null,"fd.name":null,"fd.rport":null,"fd.type":null,"proc.cmdline":"<NA>","proc.exepath":"","proc.name":"<NA>","proc.pid":-1,"proc.pname":null,"proc.tty":0,"user.loginuid":-1,"user.name":"<NA>","user.uid":4294967295}}
{"hostname":"ubuntu","output":"09:23:02.374844761: Warning Test  ( pid=-1 connection= lport=<NA> rport=<NA> fd_type=<NA> fd_proto=fd.l4proto evt_type=recvmsg user=<NA> user_uid=4294967295 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 container_id= container_name=<NA>)","priority":"Warning","rule":"Test","source":"syscall","tags":["T1021.004","container","host","maturity_deprecated","mitre_lateral_movement","network"],"time":"2024-06-11T01:23:02.374844761Z", "output_fields": {"container.id":"","container.name":null,"evt.time":1718068982374844761,"evt.type":"recvmsg","fd.lport":null,"fd.name":"","fd.rport":null,"fd.type":null,"proc.cmdline":"<NA>","proc.exepath":"","proc.name":"<NA>","proc.pid":-1,"proc.pname":null,"proc.tty":0,"user.loginuid":-1,"user.name":"<NA>","user.uid":4294967295}}
{"hostname":"ubuntu","output":"09:23:02.374858448: Warning Test  ( pid=-1 connection=<NA> lport=<NA> rport=<NA> fd_type=<NA> fd_proto=fd.l4proto evt_type=recvmsg user=<NA> user_uid=4294967295 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 container_id= container_name=<NA>)","priority":"Warning","rule":"Test","source":"syscall","tags":["T1021.004","container","host","maturity_deprecated","mitre_lateral_movement","network"],"time":"2024-06-11T01:23:02.374858448Z", "output_fields": {"container.id":"","container.name":null,"evt.time":1718068982374858448,"evt.type":"recvmsg","fd.lport":null,"fd.name":null,"fd.rport":null,"fd.type":null,"proc.cmdline":"<NA>","proc.exepath":"","proc.name":"<NA>","proc.pid":-1,"proc.pname":null,"proc.tty":0,"user.loginuid":-1,"user.name":"<NA>","user.uid":4294967295}}
{"hostname":"ubuntu","output":"09:23:02.374862339: Warning Test  ( pid=-1 connection= lport=<NA> rport=<NA> fd_type=<NA> fd_proto=fd.l4proto evt_type=recvmsg user=<NA> user_uid=4294967295 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 container_id= container_name=<NA>)","priority":"Warning","rule":"Test","source":"syscall","tags":["T1021.004","container","host","maturity_deprecated","mitre_lateral_movement","network"],"time":"2024-06-11T01:23:02.374862339Z", "output_fields": {"container.id":"","container.name":null,"evt.time":1718068982374862339,"evt.type":"recvmsg","fd.lport":null,"fd.name":"","fd.rport":null,"fd.type":null,"proc.cmdline":"<NA>","proc.exepath":"","proc.name":"<NA>","proc.pid":-1,"proc.pname":null,"proc.tty":0,"user.loginuid":-1,"user.name":"<NA>","user.uid":4294967295}}
{"hostname":"ubuntu","output":"09:23:02.374866981: Warning Test  ( pid=-1 connection=<NA> lport=<NA> rport=<NA> fd_type=<NA> fd_proto=fd.l4proto evt_type=recvmsg user=<NA> user_uid=4294967295 user_loginuid=-1 process=<NA> proc_exepath= parent=<NA> command=<NA> terminal=0 container_id= container_name=<NA>)","priority":"Warning","rule":"Test","source":"syscall","tags":["T1021.004","container","host","maturity_deprecated","mitre_lateral_movement","network"],"time":"2024-06-11T01:23:02.374866981Z", "output_fields": {"container.id":"","container.name":null,"evt.time":1718068982374866981,"evt.type":"recvmsg","fd.lport":null,"fd.name":null,"fd.rport":null,"fd.type":null,"proc.cmdline":"<NA>","proc.exepath":"","proc.name":"<NA>","proc.pid":-1,"proc.pname":null,"proc.tty":0,"user.loginuid":-1,"user.name":"<NA>","user.uid":4294967295}}

As mentioned in the above text, this issue was not found in the historical versions. Therefore, based on this situation, it is determined that it may be caused by this pull request: falcosecurity/libs#1058. The newly added get_cgroup_subsystems_v2 part leads to an error where some processes do not have a cgroup.controllers file. It is known that in /proc/1/root/run/calico/cgroup, the cgroup content cannot be found.
https://github.com/falcosecurity/libs/blob/74725244659e556ced587c2f0bec7bbd42d39b96/userspace/libscap/linux/scap_cgroup.c#L481-L499.