poprhythm
4d9d15417a
No repeat intrusion - investigated all Falco alerts since deployment (2026-08-08 to 2026-08-16); the only crypto-miner rule hits were the original test alerts. The daily self-resolving Telegram alerts the user was seeing came from four known-benign sources: Obsidian's Electron self-re-exec pattern and s6-init sudoers setup (fires ~daily on container recreation), ttyd/Synchronet's telnet/pv/busybox-extras BBS tooling, and ollama's nvidia-ctk ldconfig-refresh hook (memfd_create by design). Added scoped exceptions for each via Falco's own rule extension points, same pattern as the earlier pg_isready/gitea fixes. Also fixed netdata's used_swap alarm, which recalculated from the instantaneous raw sample every 10s with only a 30s notification debounce - a brief swap spike was enough to page both Telegram and (via Netdata Cloud) email. Widened the up-delay to 5m so only sustained swap pressure notifies. Verified end-to-end via a fresh fake-xmrig test after redeploying Falco and reloading netdata: CRITICAL alarm fired and Telegram delivery succeeded.
25 lines
1.1 KiB
Plaintext
25 lines
1.1 KiB
Plaintext
# Override of netdata's stock used_swap alarm (health.d/swap.conf). The
|
|
# stock template recalculates $used/$free from the *instantaneous* raw
|
|
# sample every 10s with only a 30s notification debounce, so a swap spike
|
|
# lasting a couple of minutes was enough to page. Only the delay line
|
|
# changes here (up 30s -> up 5m) - the rest is copied verbatim from the
|
|
# stock template since netdata health.d overrides replace the whole
|
|
# template, not just one line. This requires sustained swap pressure
|
|
# (5+ continuous minutes above threshold) before notifying, instead of
|
|
# firing on every brief spike.
|
|
template: used_swap
|
|
on: mem.swap
|
|
class: Utilization
|
|
type: System
|
|
component: Memory
|
|
host labels: _os=linux freebsd
|
|
calc: (($used + $free) > 0) ? ($used * 100 / ($used + $free)) : 0
|
|
units: %
|
|
every: 10s
|
|
warn: $this > (($status >= $WARNING) ? (80) : (90))
|
|
crit: $this > (($status == $CRITICAL) ? (90) : (98))
|
|
delay: up 5m down 15m multiplier 1.5 max 1h
|
|
summary: System swap memory utilization
|
|
info: Swap memory utilization
|
|
to: sysadmin
|