Skip to content

Prometheus metrics should include pod name and namespace as labels #3826

@mlladb

Description

@mlladb

Motivation

I'm monitoring Falco rule alerts via the Prometheus metric falcosecurity_falco_rules_matches_total, but it's difficult to identify which Kubernetes pods or namespaces triggered the alerts. I can see it in the logs of falco but not prometheus.
Was able to see it previously with falco_events from falco-exporter as k8s.ns.name and k8s.pod.name but that's deprecated now

Feature
I would like the falcosecurity_falco_rules_matches_total metric to include the following additional labels:

k8s_pod_name
k8s_ns_name

These should reflect the Kubernetes namespace and pod that triggered the Falco rule match, as already included in the event logs.

Additional context

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions