github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-29 19:23:16 +00:00
Code Issues Projects Releases Wiki Activity

chore(userspace): improved wording.

Browse Source 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
This commit is contained in:
Federico Di Pierro 2023-03-27 17:17:38 +02:00 committed by poiana
parent bd13ba70e3
commit 70c6c93389
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
falco.yaml
View File

@ -170,7 +170,8 @@ syscall_event_drops:
syscall_event_timeouts:
max_consecutives: 1000
# Enabling this option allows Falco to drop failed syscalls exit events.
# Enabling this option allows Falco to drop failed syscalls exit events
# in the kernel driver before the event is pushed onto the ring buffer.
# This can enable some small optimization both in CPU usage and ring buffer usage,
# possibly leading to lower number of event losses.
# Be careful: enabling it also means losing a bit of visibility on the system.

2
userspace/falco/app/actions/helpers_inspector.cpp
View File

@ -127,7 +127,7 @@ falco::app::run_result falco::app::actions::open_live_inspector(
if (s.config->m_syscall_drop_failed)
{
falco_logger::log(LOG_DEBUG, "Failed syscalls exit event will be dropped.\n");
falco_logger::log(LOG_DEBUG, "Failed syscall exit events are dropped in the kernel driver\n");
inspector->set_dropfailed(true);
}
return run_result::ok();