Skip to content

Prioritize thread snapshot event processing to avoid zone initialization stalls#47

Merged
bleggett merged 2 commits intomainfrom
bleggett/process-snaps-first
Jan 29, 2026
Merged

Prioritize thread snapshot event processing to avoid zone initialization stalls#47
bleggett merged 2 commits intomainfrom
bleggett/process-snaps-first

Conversation

@bleggett
Copy link
Collaborator

@bleggett bleggett commented Jan 29, 2026

Fixes: #45

Because zone snapshot events and syscall events are multiplexed over the same channel, depending on ordering and timings of zone startup, plugin init, and other things, it can be possible for syscall events to starve the event handling loop such that it never gets to the zone snapshot, and thus never properly initializes the zone watch.

This simply changes the logic to prefer processing zone initializing thread snapshots first, so they are always head-of-line, and not counted as part of the falco event limit (which is the correct behavior/what I should have done originally).

it also adds a few extra safeguards and logging fixes.

Tested with falco deployed via the Falco helm chart, versions:

Falco version: 0.43.0
Libs version:  0.23.1
Plugin API:    3.12.0
Engine:        0.58.0
Driver:
  API version:    8.0.0
  Schema version: 4.1.0
  Default driver: 9.1.0+driver

@bleggett bleggett force-pushed the bleggett/process-snaps-first branch from 2f75ad3 to a3f672e Compare January 29, 2026 20:09
@bleggett bleggett merged commit 05244ec into main Jan 29, 2026
5 checks passed
@bleggett bleggett deleted the bleggett/process-snaps-first branch January 29, 2026 20:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug Report: Falco Edera Plugin — "ignoring event for unknown zone"

2 participants