feat: capture events filesize limits by leogr · Pull Request #3824 · falcosecurity/falco

leogr · 2026-03-17T13:12:56Z

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

/kind release

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area build

/area engine

/area tests

/area proposals

/area CI

What this PR does / why we need it:

This adds capture_events and capture_filesize (kB) as new stop conditions for capture files, both as per-rule fields and as global config defaults (default_events, default_filesize). When multiple conditions are configured alongside the existing capture_duration, the first one that is met stops the capture (OR semantics).

Also fixes:

pre-existing gaps in the rule Override JSON schema
and adds comprehensive unit tests for all capture-related fields.

Which issue(s) this PR fixes:

Fixes #3764

Special notes for your reviewer:

/milestone 0.44.0

cc @geraldcombs

Does this PR introduce a user-facing change?:

new(config,rules): add `capture_events` and `capture_filesize` stop conditions for capture files

ekoops

I'd replace filesize with file_size everywhere, but I'm gonna approve it. Feel free to change or mantain it as is.
/approve

leogr · 2026-03-17T14:29:15Z

I'd replace filesize with file_size everywhere, but I'm gonna approve it. Feel free to change or mantain it as is. /approve

good point. Just
/hold

to collect some more feedback about this

geraldcombs · 2026-03-17T22:42:46Z

-# in milliseconds.
+# in milliseconds. Optionally, set `capture.default_events` to limit the
+# number of captured events, and `capture.default_filesize` to limit the
+# capture file size in kB.


Should this be "kiB"? There was a big push to use IEC units for base 2 prefixes years ago, but I'm not sure where best practices stand nowadays.

This looks great otherwise!

Good point 🤔

I checked, and the Falco project consistently uses SI-style unit names everywhere (e.g., rollover_mb in sinsp_cycledumper, convert_memory_to_mb, and kb for RSS/PSS/VSZ in Falco metrics). There are no IEC units (kiB, MiB) used anywhere in either falco or libs.

I believe sticking with kB here is the right call for consistency with the rest of the codebase, even though technically the code multiplies by 1024.

Likely, it is worth keeping a note for a full review of Falco with respect to the units convention.

Thanks for the review! 🙏

Does the documentation for these configuration variables use SI units?

No, there's no documentation. It's just the convention of the current implementation.

leogr · 2026-04-10T12:55:25Z

/hold cancel

github-actions · 2026-04-14T09:43:11Z

This PR may bring feature or behavior changes in the Falco engine and may require the engine version to be bumped.

Please double check userspace/engine/falco_engine_version.h file. See versioning for FALCO_ENGINE_VERSION.

/hold

leogr · 2026-04-14T10:33:20Z

/remove-hold

leogr · 2026-04-24T09:21:51Z

@irozzo-1A @ekoops @geraldcombs PTAL again 🙏

Co-authored-by: Alessandro Cannarella <cannarella.dev@gmail.com> Co-authored-by: Gerald Combs <gerald@wireshark.org> Co-authored-by: Iacopo Rozzo <iacopo@sysdig.com> Co-authored-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com> Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

geraldcombs

This looks good, and I think making the file size a hard limit makes sense.

geraldcombs · 2026-04-28T16:28:03Z

+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+
+	auto rule_description = m_engine->describe_rule(&rule_name, {});
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture"].template get<bool>(), true);


Should there be an assertion for the default duration here?

irozzo-1A

/lgtm

poiana · 2026-04-29T08:26:55Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, geraldcombs, irozzo-1A, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [ekoops,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

github-project-automation Bot added this to Falco Roadmap Mar 17, 2026

poiana added the release-note label Mar 17, 2026

github-project-automation Bot moved this to Todo in Falco Roadmap Mar 17, 2026

poiana added this to the 0.44.0 milestone Mar 17, 2026

poiana added kind/feature dco-signoff: yes area/engine area/tests labels Mar 17, 2026

poiana requested review from Kaizhe and irozzo-1A March 17, 2026 13:13

poiana added size/XL approved labels Mar 17, 2026

ekoops previously approved these changes Mar 17, 2026

View reviewed changes

poiana assigned ekoops Mar 17, 2026

poiana added the lgtm label Mar 17, 2026

poiana added the do-not-merge/hold label Mar 17, 2026

geraldcombs reviewed Mar 17, 2026

View reviewed changes

poiana removed the do-not-merge/hold label Apr 10, 2026

leogr dismissed ekoops’s stale review via c089007 April 14, 2026 09:42

leogr force-pushed the feat/capture-events-filesize-limits branch from e41c2de to c089007 Compare April 14, 2026 09:42

poiana added the do-not-merge/hold label Apr 14, 2026

leogr force-pushed the feat/capture-events-filesize-limits branch from c089007 to 495f943 Compare April 14, 2026 10:23

poiana removed the do-not-merge/hold label Apr 14, 2026

ekoops previously approved these changes Apr 14, 2026

View reviewed changes

irozzo-1A reviewed Apr 14, 2026

View reviewed changes

Comment thread falco.yaml Outdated

leogr dismissed ekoops’s stale review via 3e06d1e April 20, 2026 09:41

leogr force-pushed the feat/capture-events-filesize-limits branch from 495f943 to 3e06d1e Compare April 20, 2026 09:41

leogr requested review from ekoops, geraldcombs and irozzo-1A April 20, 2026 09:42

ekoops reviewed Apr 27, 2026

View reviewed changes

Comment thread userspace/falco/app/actions/process_events.cpp Outdated

leogr force-pushed the feat/capture-events-filesize-limits branch from 3e06d1e to 723d8e5 Compare April 27, 2026 10:35

leogr and others added 2 commits April 27, 2026 13:20

chore(unit_tests): capture feature testing

6d3cb8c

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

leogr force-pushed the feat/capture-events-filesize-limits branch from 723d8e5 to 6d3cb8c Compare April 27, 2026 11:23

ekoops approved these changes Apr 27, 2026

View reviewed changes

geraldcombs approved these changes Apr 28, 2026

View reviewed changes

poiana assigned geraldcombs Apr 28, 2026

irozzo-1A approved these changes Apr 29, 2026

View reviewed changes

github-project-automation Bot moved this from Todo to In progress in Falco Roadmap Apr 29, 2026

poiana assigned irozzo-1A Apr 29, 2026

poiana merged commit 9b72af5 into master Apr 29, 2026
32 checks passed

poiana deleted the feat/capture-events-filesize-limits branch April 29, 2026 08:27

github-project-automation Bot moved this from In progress to Done in Falco Roadmap Apr 29, 2026

Conversation

leogr commented Mar 17, 2026

Uh oh!

ekoops left a comment

Choose a reason for hiding this comment

Uh oh!

leogr commented Mar 17, 2026

Uh oh!

geraldcombs Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

leogr Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

ekoops Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

leogr Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

leogr commented Apr 10, 2026

Uh oh!

github-actions Bot commented Apr 14, 2026

Uh oh!

leogr commented Apr 14, 2026

Uh oh!

Uh oh!

leogr commented Apr 24, 2026

Uh oh!

Uh oh!

geraldcombs left a comment

Choose a reason for hiding this comment

Uh oh!

geraldcombs Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

irozzo-1A left a comment

Choose a reason for hiding this comment

Uh oh!

poiana commented Apr 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

geraldcombs Mar 17, 2026 •

edited

Loading