-
Notifications
You must be signed in to change notification settings - Fork 2k
Description
Wazuh version | Component | Install type | Install method | Platform |
---|---|---|---|---|
v4.7.2-40711 | rootcheck(and others) | Agent | APT repo Package | Ubuntu 22.04.3 LTS |
I completely understand why nfs and cifs have an option to be skipped. That is because it's a remote filesystem and multiple agents scanning the same files is not a good idea. However NFS and CIFS are not the only ones.
For example:
I have CephFS volumes mounted on multiple (hundreds) pods in multiple kubernetes clusters with "ReadWriteMany" mode. Meaning they all have that mounted at the same time. So agent being deployed on all nodes just traverses everything under /var/lib with rootcheck.
/var/lib/kubelet/pods/<UID>/volumes/kubernetes.io~csi/<volume_name>/mount
is mounted multiple times even on the same node.
lsof
shows a ton of open operations typed DIR
I don't want to get into cephfs internals, but this in ends up in slow operations or oversized cache between client and ceph metadata service, since the same operations are coming from a lot of clients and the same time.
Mounting is done from kernel, not fuse.
Since "yet-another-hardcoded-value" does not look like the best possible solution, my suggestion is to make this configurable somehow. Like there's the skipFS function:
https://github.com/wazuh/wazuh-agent/blob/master/src/common/fs_op/src/fs_op.c#L96
I think this could be configurable. Though the values of FS type are predefined, I don't believe there isn't another way to detect FS type.