Skip to content

Feature Request: Add CephFS type to skip_nfs flag #25587

@audriusb

Description

@audriusb
Wazuh version Component Install type Install method Platform
v4.7.2-40711 rootcheck(and others) Agent APT repo Package Ubuntu 22.04.3 LTS

I completely understand why nfs and cifs have an option to be skipped. That is because it's a remote filesystem and multiple agents scanning the same files is not a good idea. However NFS and CIFS are not the only ones.

For example:
I have CephFS volumes mounted on multiple (hundreds) pods in multiple kubernetes clusters with "ReadWriteMany" mode. Meaning they all have that mounted at the same time. So agent being deployed on all nodes just traverses everything under /var/lib with rootcheck.

/var/lib/kubelet/pods/<UID>/volumes/kubernetes.io~csi/<volume_name>/mount is mounted multiple times even on the same node.

lsof shows a ton of open operations typed DIR I don't want to get into cephfs internals, but this in ends up in slow operations or oversized cache between client and ceph metadata service, since the same operations are coming from a lot of clients and the same time.

Mounting is done from kernel, not fuse.

Since "yet-another-hardcoded-value" does not look like the best possible solution, my suggestion is to make this configurable somehow. Like there's the skipFS function:
https://github.com/wazuh/wazuh-agent/blob/master/src/common/fs_op/src/fs_op.c#L96
I think this could be configurable. Though the values of FS type are predefined, I don't believe there isn't another way to detect FS type.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions