diff --git a/userspace/falco/app/actions/helpers_interesting_sets.cpp b/userspace/falco/app/actions/helpers_interesting_sets.cpp index 3637abbb..4592eae6 100644 --- a/userspace/falco/app/actions/helpers_interesting_sets.cpp +++ b/userspace/falco/app/actions/helpers_interesting_sets.cpp @@ -15,7 +15,6 @@ limitations under the License. */ #include "actions.h" -#include using namespace falco::app; using namespace falco::app::actions; @@ -52,7 +51,7 @@ static void check_for_rules_unsupported_events(falco::app::state& s, const libsi /* Get the names of the events (syscall and non syscall events) that were not activated and print them. */ auto names = libsinsp::events::event_set_to_names(unsupported_event_set); std::cerr << "Loaded rules match event types that are not activated or unsupported with current configuration: warning (unsupported-evttype): " + concat_set_in_order(names) << std::endl; - std::cerr << "If syscalls in rules include high volume I/O syscalls (-> activate via `-A` flag), else (2) syscalls might be associated with syscalls undefined on your architecture (https://marcin.juszkiewicz.com.pl/download/tables/syscalls.html)" << std::endl; + std::cerr << "If syscalls in rules include high volume I/O syscalls (-> activate via `-A` flag), else syscalls might be associated with syscalls undefined on your architecture (https://marcin.juszkiewicz.com.pl/download/tables/syscalls.html)" << std::endl; } static void select_event_set(falco::app::state& s, const libsinsp::events::set& rules_event_set) @@ -64,7 +63,7 @@ static void select_event_set(falco::app::state& s, const libsinsp::events::set

activate via `-A` flag): " + + concat_set_in_order(erased_event_set_names) + "\n"); } } if (!s.selected_event_set.empty()) { - falco_logger::log(LOG_DEBUG, "(" + std::to_string(s.selected_event_set.size()) - + ") syscalls in total activated (final set): " - + concat_set_in_order(libsinsp::events::event_set_to_names(s.selected_event_set)) + "\n"); + auto selected_event_set_names = libsinsp::events::event_set_to_names(s.selected_event_set); + falco_logger::log(LOG_DEBUG, "(" + std::to_string(selected_event_set_names.size()) + + ") events selected in total (final set): " + + concat_set_in_order(selected_event_set_names) + "\n"); } } diff --git a/userspace/falco/app/actions/print_ignored_events.cpp b/userspace/falco/app/actions/print_ignored_events.cpp index 9f868a10..606e460c 100644 --- a/userspace/falco/app/actions/print_ignored_events.cpp +++ b/userspace/falco/app/actions/print_ignored_events.cpp @@ -16,12 +16,9 @@ limitations under the License. #include "actions.h" #include "helpers.h" -#include "falco_utils.h" using namespace falco::app; using namespace falco::app::actions; -using namespace falco::utils; - falco::app::run_result falco::app::actions::print_ignored_events(falco::app::state& s) {