diff --git a/test/README.md b/test/README.md index f77b65a5..5640283f 100644 --- a/test/README.md +++ b/test/README.md @@ -26,7 +26,7 @@ make test-trace-files It prepares the fixtures (`json` and `scap` files) needed by the integration tests. -Using `virtualenv` the steps to locally run a specific test suite are the following ones (from this directory): +Using `virtualenv` the steps to locally run a specific test suite are the following ones (**from this directory**): ```console virtualenv venv diff --git a/test/confs/drops_ignore_log.yaml b/test/confs/drops_ignore_log.yaml new file mode 100644 index 00000000..842f087b --- /dev/null +++ b/test/confs/drops_ignore_log.yaml @@ -0,0 +1,12 @@ +syscall_event_drops: + actions: + - ignore + - log + rate: .03333 + max_burst: 10 + simulate_drops: true + +stdout_output: + enabled: true + +log_stderr: true diff --git a/test/falco_tests.yaml b/test/falco_tests.yaml index 0e2cef9b..b2de2cde 100644 --- a/test/falco_tests.yaml +++ b/test/falco_tests.yaml @@ -1227,6 +1227,15 @@ trace_files: !mux stdout_not_contains: - "Falco internal: syscall event drop" + monitor_syscall_drops_ignore_and_log: + exit_status: 1 + rules_file: + - rules/single_rule.yaml + conf_file: confs/drops_ignore_log.yaml + trace_file: trace_files/ping_sendto.scap + stderr_contains: + - "syscall event drop action \"log\" does not make sense with the \"ignore\" action" + monitor_syscall_drops_log: exit_status: 0 rules_file: