Remote Unix Monitoring extension mount exclude rules hints

[rastislav_danis]

Remote Unix Monitoring extension allows to create exclude/include mount filters for each configured endpoint. However, creating just exclude filter (f.e. for /run mount) results in excluding all mounts. It's because python code is written this way:

mount_filters = self.config.get("mount_filters", []) if self.config.get("mount_filters") != [] else [{"filter_type": "include", "pattern": ".*"}]

So if mount_filters is not empty, default include filter pattern is not set to ".*". So it's required to manually add include filter with ".*" along with any exclude filter in configuration. Example of working filter setup:

Another potential issue can be in case of excluding mounts with names like "/dev", because code matches exclude pattern not only with mount.mounted_on names but also with mount.file_system names.

re.findall(filter_pattern, mount.file_system) or re.findall(filter_pattern, mount.mounted_on)

So mount_file_system with name "/dev/mapper" mounted_on "/" will be excluded with "/dev" exclude filter as well.