diff --git a/userspace/falco/falco.cpp b/userspace/falco/falco.cpp
index 5e324fb5..5223aa64 100644
--- a/userspace/falco/falco.cpp
+++ b/userspace/falco/falco.cpp
@@ -22,6 +22,8 @@ along with falco. If not, see .
#include
#include
#include
+#include
+#include
#include
#include
#include
@@ -32,6 +34,7 @@ along with falco. If not, see .
#include
#include "logger.h"
+#include "utils.h"
#include "configuration.h"
#include "falco_engine.h"
@@ -241,6 +244,47 @@ uint64_t do_inspect(falco_engine *engine,
return num_evts;
}
+static void print_all_ignored_events(sinsp *inspector)
+{
+ sinsp_evttables* einfo = inspector->get_event_info_tables();
+ const struct ppm_event_info* etable = einfo->m_event_info;
+ const struct ppm_syscall_desc* stable = einfo->m_syscall_info_table;
+
+ std::set ignored_event_names;
+ for(uint32_t j = 0; j < PPM_EVENT_MAX; j++)
+ {
+ if(!sinsp::falco_consider_evtnum(j))
+ {
+ std::string name = etable[j].name;
+ // Ignore event names NA*
+ if(name.find("NA") != 0)
+ {
+ ignored_event_names.insert(name);
+ }
+ }
+ }
+
+ for(uint32_t j = 0; j < PPM_SC_MAX; j++)
+ {
+ if(!sinsp::falco_consider_syscallid(j))
+ {
+ std::string name = stable[j].name;
+ // Ignore event names NA*
+ if(name.find("NA") != 0)
+ {
+ ignored_event_names.insert(name);
+ }
+ }
+ }
+
+ printf("Ignored Event(s):");
+ for(auto it : ignored_event_names)
+ {
+ printf(" %s", it.c_str());
+ }
+ printf("\n");
+}
+
//
// ARGUMENT PARSING AND PROGRAM SETUP
//
@@ -270,6 +314,7 @@ int falco_init(int argc, char **argv)
string output_format = "";
bool replace_container_info = false;
int duration_to_tot = 0;
+ bool print_ignored_events = false;
// Used for writing trace files
int duration_seconds = 0;
@@ -299,6 +344,7 @@ int falco_init(int argc, char **argv)
{"version", no_argument, 0, 0 },
{"validate", required_argument, 0, 'V' },
{"writefile", required_argument, 0, 'w' },
+ {"ignored-events", no_argument, 0, 'i'},
{0, 0, 0, 0}
};
@@ -315,7 +361,7 @@ int falco_init(int argc, char **argv)
// Parse the args
//
while((op = getopt_long(argc, argv,
- "hc:AdD:e:k:K:Ll:m:M:o:P:p:r:s:T:t:UvV:w:",
+ "hc:AdD:e:ik:K:Ll:m:M:o:P:p:r:s:T:t:UvV:w:",
long_options, &long_index)) != -1)
{
switch(op)
@@ -341,6 +387,9 @@ int falco_init(int argc, char **argv)
k8s_api = new string();
mesos_api = new string();
break;
+ case 'i':
+ print_ignored_events = true;
+ break;
case 'k':
k8s_api = new string(optarg);
break;
@@ -431,12 +480,20 @@ int falco_init(int argc, char **argv)
return EXIT_SUCCESS;
}
-
inspector = new sinsp();
+
+ if(print_ignored_events)
+ {
+ print_all_ignored_events(inspector);
+ delete(inspector);
+ return EXIT_SUCCESS;
+ }
+
engine = new falco_engine();
engine->set_inspector(inspector);
engine->set_extra(output_format, replace_container_info);
+
outputs = new falco_outputs();
outputs->set_inspector(inspector);