From 600501e1410fe397db5378ccf1b3f51623e721d3 Mon Sep 17 00:00:00 2001 From: Leonardo Di Donato Date: Fri, 16 Apr 2021 10:38:06 +0000 Subject: [PATCH] update(userspace/falco): handle the case there wasn't been any previously processed event Signed-off-by: Leonardo Di Donato --- userspace/falco/falco.cpp | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/userspace/falco/falco.cpp b/userspace/falco/falco.cpp index 1edd5a6de99..4bb01a76db5 100644 --- a/userspace/falco/falco.cpp +++ b/userspace/falco/falco.cpp @@ -309,8 +309,11 @@ uint64_t do_inspect(falco_engine *engine, { std::string rule = "Falco internal: timeouts notification"; std::string msg = rule + ". " + std::to_string(config.m_syscall_evt_timeout_max_consecutives) + " consecutive timeouts without event."; - std::string last_event_time_str; - sinsp_utils::ts_to_string(duration_start, &last_event_time_str, false, true); + std::string last_event_time_str = "none"; + if(duration_start > 0) + { + sinsp_utils::ts_to_string(duration_start, &last_event_time_str, false, true); + } std::map o = { {"last_event_time", last_event_time_str}, };