Process Kubernetes Events

Use the configurations on this page streamline Sysdig agent processing times, reduce CPU load, and improve capture of container metadata.

Process Kubernetes Events

Cluster shield

To manage the collection of Kubernetes events on Sysdig Monitor using Cluster Shield, apply the following configuration:

features:
  monitor:
    kubernetes_events:
      enabled: false

Classic Agent

To streamline Sysdig agent processing times and reduce CPU load, you can use an updated processing engine written in Go.

To do so, edit the following code in dragent.yaml:

go_k8s_user_events: true

Kubernetes Audit Events

The agent listens on /k8s-audit for Kubernetes audit events. Configure the path using the following configuration option:

security:{k8s_audit_server_path_uris: [path1, path2]}

For more information, see Kubernetes Audit Logging.

Working with containerd in K3S

If you have containerd using a custom socket, you can specify this parameter in the agent configuration to correctly capture the containers’ metadata:

cri:
  socket_path: /run/k3s/containerd/containerd.sock