Skip to content

Commit 1ef216b

Browse files
[ASM] Error metric for unknown operator errors (#6465)
When we experience an "unknown matcher operator" error in the WAF, we should not increase the _dd.appsec.event_rules.error_count metric in the span. ## Summary of changes ## Reason for change ## Implementation details ## Test coverage ## Other details <!-- Fixes #{issue} --> <!-- ⚠️ Note: where possible, please obtain 2 approvals prior to merging. Unless CODEOWNERS specifies otherwise, for external teams it is typically best to have one review from a team member, and one review from apm-dotnet. Trivial changes do not require 2 reviews. -->
1 parent 5bbffca commit 1ef216b

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

tracer/src/Datadog.Trace/AppSec/Coordinator/SecurityCoordinator.Reporter.cs

+5-2
Original file line numberDiff line numberDiff line change
@@ -92,8 +92,11 @@ internal static void ReportWafInitInfoOnce(Security security, Span span)
9292
security.WafInitResult.Reported = true;
9393
span.Context.TraceContext?.SetSamplingPriority(SamplingPriorityValues.UserKeep, SamplingMechanism.Asm);
9494
span.SetMetric(Metrics.AppSecWafInitRulesLoaded, security.WafInitResult.LoadedRules);
95-
span.SetMetric(Metrics.AppSecWafInitRulesErrorCount, security.WafInitResult.FailedToLoadRules);
96-
if (security.WafInitResult.HasErrors && !Security.HasOnlyUnknownMatcherErrors(security.WafInitResult.Errors))
95+
bool onlyUnknownMatcherErrors = Security.HasOnlyUnknownMatcherErrors(security.WafInitResult.Errors);
96+
97+
// If there are only unknown matcher errors, we don't want to report the failures
98+
span.SetMetric(Metrics.AppSecWafInitRulesErrorCount, onlyUnknownMatcherErrors ? 0 : security.WafInitResult.FailedToLoadRules);
99+
if (security.WafInitResult.HasErrors && !onlyUnknownMatcherErrors)
97100
{
98101
span.SetTag(Tags.AppSecWafInitRuleErrors, security.WafInitResult.ErrorMessage);
99102
}

0 commit comments

Comments
 (0)