Skip to content

Commit

Permalink
[ASM] Error metric for unknown operator errors (#6465)
Browse files Browse the repository at this point in the history
When we experience an "unknown matcher operator" error in the WAF, we
should not increase the _dd.appsec.event_rules.error_count metric in the
span.

## Summary of changes

## Reason for change

## Implementation details

## Test coverage

## Other details
<!-- Fixes #{issue} -->

<!-- ⚠️ Note: where possible, please obtain 2 approvals prior to
merging. Unless CODEOWNERS specifies otherwise, for external teams it is
typically best to have one review from a team member, and one review
from apm-dotnet. Trivial changes do not require 2 reviews. -->
  • Loading branch information
NachoEchevarria authored Dec 23, 2024
1 parent 5bbffca commit 1ef216b
Showing 1 changed file with 5 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -92,8 +92,11 @@ internal static void ReportWafInitInfoOnce(Security security, Span span)
security.WafInitResult.Reported = true;
span.Context.TraceContext?.SetSamplingPriority(SamplingPriorityValues.UserKeep, SamplingMechanism.Asm);
span.SetMetric(Metrics.AppSecWafInitRulesLoaded, security.WafInitResult.LoadedRules);
span.SetMetric(Metrics.AppSecWafInitRulesErrorCount, security.WafInitResult.FailedToLoadRules);
if (security.WafInitResult.HasErrors && !Security.HasOnlyUnknownMatcherErrors(security.WafInitResult.Errors))
bool onlyUnknownMatcherErrors = Security.HasOnlyUnknownMatcherErrors(security.WafInitResult.Errors);

// If there are only unknown matcher errors, we don't want to report the failures
span.SetMetric(Metrics.AppSecWafInitRulesErrorCount, onlyUnknownMatcherErrors ? 0 : security.WafInitResult.FailedToLoadRules);
if (security.WafInitResult.HasErrors && !onlyUnknownMatcherErrors)
{
span.SetTag(Tags.AppSecWafInitRuleErrors, security.WafInitResult.ErrorMessage);
}
Expand Down

0 comments on commit 1ef216b

Please sign in to comment.