expose num_evts metric in Prometheus output (#3584)

The `num_evts` counter is already emitted by the JSON / text stats
sinks (via stats_writer::collector::get_metrics_output_fields_wrapper)
but the Prometheus output sink at /metrics never got it. Anyone
running Falco with prometheus_metrics_enabled couldn't see how many
events the agent had processed.

Three small wires to bridge the gap:

  app/state.h
    add `std::atomic<uint64_t> num_evts = 0;` to the shared state
    so a counter is reachable from both the per-source event loop
    and the prometheus sink without plumbing stats_writer through.

  app/actions/process_events.cpp
    after each `num_evts++` for the local source counter, also
    bump `s.num_evts` with relaxed memory ordering. Cheap, lock-free
    counter increment per event.

  falco_metrics.cpp
    emit a `falcosecurity_falco_num_evts_total` counter alongside the
    existing `falcosecurity_falco_outputs_queue_num_drops_total` block
    in `falco_to_text_prometheus`. Same metric type / unit pattern as
    the queue-drops counter just above it.

Output:

    # HELP falcosecurity_falco_num_evts_total https://falco.org/docs/metrics/
    # TYPE falcosecurity_falco_num_evts_total counter
    falcosecurity_falco_num_evts_total 12345

Author: ChrisJr404

userspace/falco/app/actions/process_events.cpp

@@ -386,6 +386,10 @@ static falco::app::run_result do_inspect(
 		}
 
 		num_evts++;
+		// Mirror the per-source counter into the shared state so the
+		// Prometheus output sink can publish a global `num_evts` metric
+		// alongside the JSON / text sinks. See issue #3584.
+		s.num_evts.fetch_add(1, std::memory_order_relaxed);
 	}
 
 	return run_result::ok();

userspace/falco/app/state.h

@@ -74,6 +74,13 @@ struct state {
 	falco::app::options options;
 	std::atomic<bool> restart = false;
 
+	// Cumulative count of userspace events processed by Falco across every
+	// loaded event source. Maintained by the per-source event loop in
+	// process_events.cpp and read by the Prometheus output sink so the
+	// `falco.num_evts` value already exposed via stats_writer is also
+	// available on /metrics. See issue #3584.
+	std::atomic<uint64_t> num_evts = 0;
+
 	std::shared_ptr<falco_configuration> config;
 	std::shared_ptr<falco_outputs> outputs;
 	std::shared_ptr<falco_engine> engine;

userspace/falco/falco_metrics.cpp

@@ -162,6 +162,21 @@ std::string falco_metrics::falco_to_text_prometheus(
 		        state.outputs->get_outputs_queue_num_drops()));
 	}
 
+	// # HELP falcosecurity_falco_num_evts_total https://falco.org/docs/metrics/
+	// # TYPE falcosecurity_falco_num_evts_total counter
+	// falcosecurity_falco_num_evts_total 12345
+	//
+	// Exposes the same `num_evts` counter that the JSON / text stats sinks
+	// already emit via stats_writer; aggregated across every event source.
+	// See issue #3584.
+	additional_wrapper_metrics.emplace_back(libs::metrics::libsinsp_metrics::new_metric(
+	        "num_evts",
+	        METRICS_V2_MISC,
+	        METRIC_VALUE_TYPE_U64,
+	        METRIC_VALUE_UNIT_COUNT,
+	        METRIC_VALUE_METRIC_TYPE_MONOTONIC,
+	        state.num_evts.load(std::memory_order_relaxed)));
+
 	// # HELP falcosecurity_falco_reload_timestamp_nanoseconds https://falco.org/docs/metrics/
 	// # TYPE falcosecurity_falco_reload_timestamp_nanoseconds gauge
 	// falcosecurity_falco_reload_timestamp_nanoseconds 1748338536592811359