diff --git a/userspace/engine/evttype_index_ruleset.cpp b/userspace/engine/evttype_index_ruleset.cpp index abbe8192..8c75e89c 100644 --- a/userspace/engine/evttype_index_ruleset.cpp +++ b/userspace/engine/evttype_index_ruleset.cpp @@ -19,6 +19,8 @@ limitations under the License. #include "falco_utils.h" +#include "../falco/logger.h" + #include evttype_index_ruleset::evttype_index_ruleset( @@ -225,7 +227,22 @@ void evttype_index_ruleset::add( void evttype_index_ruleset::on_loading_complete() { - // nothing to do for now + print_enabled_rules_falco_logger(); +} + +void evttype_index_ruleset::print_enabled_rules_falco_logger() +{ + falco_logger::log(falco_logger::level::DEBUG, "Enabled rules:\n"); + for (const auto& ruleset_ptr : m_rulesets) + { + if (ruleset_ptr) + { + for (const auto& wrap : ruleset_ptr->get_filters()) + { + falco_logger::log(falco_logger::level::DEBUG, std::string(" ") + wrap->rule.name + "\n"); + } + } + } } void evttype_index_ruleset::clear() diff --git a/userspace/engine/evttype_index_ruleset.h b/userspace/engine/evttype_index_ruleset.h index bf7b71a7..01ac4e30 100644 --- a/userspace/engine/evttype_index_ruleset.h +++ b/userspace/engine/evttype_index_ruleset.h @@ -52,6 +52,10 @@ public: void on_loading_complete() override; + // Print each enabled rule when running Falco with falco logger + // log_level=debug; invoked within on_loading_complete() + void print_enabled_rules_falco_logger(); + void enable( const std::string &pattern, match_type match, @@ -118,6 +122,11 @@ private: uint64_t num_filters(); + inline const std::set>& get_filters() const + { + return m_filters; + } + // Evaluate an event against the ruleset and return the first rule // that matched. bool run(sinsp_evt *evt, falco_rule& match);