diff --git a/userspace/falco/app/actions/helpers_inspector.cpp b/userspace/falco/app/actions/helpers_inspector.cpp index 4ed98f51..763c67d7 100644 --- a/userspace/falco/app/actions/helpers_inspector.cpp +++ b/userspace/falco/app/actions/helpers_inspector.cpp @@ -125,10 +125,5 @@ falco::app::run_result falco::app::actions::open_live_inspector( return run_result::fatal(e.what()); } - if (s.config->m_syscall_drop_failed_exit) - { - falco_logger::log(LOG_DEBUG, "Failed syscall exit events are dropped in the kernel driver\n"); - inspector->set_dropfailed(true); - } return run_result::ok(); } diff --git a/userspace/falco/app/actions/init_inspectors.cpp b/userspace/falco/app/actions/init_inspectors.cpp index b28580f3..15a2a306 100644 --- a/userspace/falco/app/actions/init_inspectors.cpp +++ b/userspace/falco/app/actions/init_inspectors.cpp @@ -48,6 +48,12 @@ static void init_syscall_inspector(falco::app::state& s, std::shared_ptr inspector->set_snaplen(s.options.snaplen); } + if (s.config->m_syscall_drop_failed_exit) + { + falco_logger::log(LOG_INFO, "Failed syscall exit events are dropped in the kernel driver\n"); + inspector->set_dropfailed(true); + } + inspector->set_hostname_and_port_resolution_mode(false); }