diff --git a/test/falco_tests.yaml b/test/falco_tests.yaml index 79555c88..c4b37100 100644 --- a/test/falco_tests.yaml +++ b/test/falco_tests.yaml @@ -1233,6 +1233,12 @@ trace_files: !mux - rules/single_rule.yaml conf_file: confs/drops_ignore_log.yaml trace_file: trace_files/ping_sendto.scap + stderr_not_contains: + - "event drop detected: 9 occurrences" + - "num times actions taken: 9" + - "Falco internal: syscall event drop" + stdout_not_contains: + - "Falco internal: syscall event drop" stderr_contains: - "syscall event drop action \"log\" does not make sense with the \"ignore\" action" @@ -1242,6 +1248,12 @@ trace_files: !mux - rules/single_rule.yaml conf_file: confs/drops_threshold_oor.yaml trace_file: trace_files/ping_sendto.scap + stderr_not_contains: + - "event drop detected: 9 occurrences" + - "num times actions taken: 9" + - "Falco internal: syscall event drop" + stdout_not_contains: + - "Falco internal: syscall event drop" stderr_contains: - "syscall event drops threshold must be a double in the range" @@ -1251,6 +1263,12 @@ trace_files: !mux - rules/single_rule.yaml conf_file: confs/drops_threshold_neg.yaml trace_file: trace_files/ping_sendto.scap + stderr_not_contains: + - "event drop detected: 9 occurrences" + - "num times actions taken: 9" + - "Falco internal: syscall event drop" + stdout_not_contains: + - "Falco internal: syscall event drop" stderr_contains: - "syscall event drops threshold must be a double in the range"