github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-12 21:16:33 +00:00
Code Issues Projects Releases Wiki Activity

update: change cpus_for_each_syscall_buffer default value

Browse Source 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
This commit is contained in:
Andrea Terzolo
2023-02-03 12:10:46 +01:00
committed by poiana
parent 13b66c95ef
commit 1b11a041b5
3 changed files with 29 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
userspace/falco/app_actions/load_rules_files.cpp
View File

@@ -172,6 +172,14 @@ application::run_result application::load_rules_files()
check_for_ignored_events();
}
if(m_options.all_events && m_options.modern_bpf)
{
/* Right now the modern BPF probe doesn't support the -A flag, we implemented just
* the "simple set" syscalls.
*/
falco_logger::log(LOG_INFO, "The '-A' flag has no effect with the modern BPF probe, no further syscalls will be added\n");
}
if (m_options.describe_all_rules)
{
m_state->engine->describe_rule(NULL);

4
userspace/falco/configuration.cpp
View File

@@ -57,7 +57,7 @@ falco_configuration::falco_configuration():
m_metadata_download_chunk_wait_us(1000),
m_metadata_download_watch_freq_sec(1),
m_syscall_buf_size_preset(4),
m_cpus_for_each_syscall_buffer(1)
m_cpus_for_each_syscall_buffer(2)
{
}
@@ -311,7 +311,7 @@ void falco_configuration::load_yaml(const std::string& config_name, const yaml_h
*/
m_syscall_buf_size_preset = config.get_scalar<uint16_t>("syscall_buf_size_preset", 4);
m_cpus_for_each_syscall_buffer = config.get_scalar<uint16_t>("modern_bpf.cpus_for_each_syscall_buffer", 1);
m_cpus_for_each_syscall_buffer = config.get_scalar<uint16_t>("modern_bpf.cpus_for_each_syscall_buffer", 2);
std::set<std::string> load_plugins;