10cc1c823b473ecfae83bd06ba13e62c9835a409
This alarm was originally the crude proxy for catching cryptominers, but Falco now detects that directly via process/network behavior. It was firing several times a day from Ollama's legitimate sustained CPU use (subwave-controller driving chat completions), with no way to tell that apart from a real problem using aggregate CPU % alone. Routed to netdata's "silent" role so it stays visible on the dashboard but stops paging Telegram/Cloud email.
docker-infrastructure
Languages
Shell
58.2%
Python
28%
JavaScript
10.5%
HTML
2.3%
DIGITAL Command Language
0.6%
Other
0.4%