diff --git a/falco.yaml b/falco.yaml index e60ccb5f..cd857523 100644 --- a/falco.yaml +++ b/falco.yaml @@ -170,7 +170,8 @@ syscall_event_drops: syscall_event_timeouts: max_consecutives: 1000 -# Enabling this option allows Falco to drop failed syscalls exit events. +# Enabling this option allows Falco to drop failed syscalls exit events +# in the kernel driver before the event is pushed onto the ring buffer. # This can enable some small optimization both in CPU usage and ring buffer usage, # possibly leading to lower number of event losses. # Be careful: enabling it also means losing a bit of visibility on the system. diff --git a/userspace/falco/app/actions/helpers_inspector.cpp b/userspace/falco/app/actions/helpers_inspector.cpp index ade62702..bf6c4e92 100644 --- a/userspace/falco/app/actions/helpers_inspector.cpp +++ b/userspace/falco/app/actions/helpers_inspector.cpp @@ -127,7 +127,7 @@ falco::app::run_result falco::app::actions::open_live_inspector( if (s.config->m_syscall_drop_failed) { - falco_logger::log(LOG_DEBUG, "Failed syscalls exit event will be dropped.\n"); + falco_logger::log(LOG_DEBUG, "Failed syscall exit events are dropped in the kernel driver\n"); inspector->set_dropfailed(true); } return run_result::ok();