diff --git a/userspace/engine/falco_engine.cpp b/userspace/engine/falco_engine.cpp index b2b043a3..9110acc0 100644 --- a/userspace/engine/falco_engine.cpp +++ b/userspace/engine/falco_engine.cpp @@ -174,6 +174,7 @@ std::unique_ptr falco_engine::load_rules(const std::string &rules_c // clear the rules known by the engine and each ruleset m_rules.clear(); for (auto &src : m_sources) + // add rules to each ruleset { src.ruleset = src.ruleset_factory->new_ruleset(); } @@ -181,12 +182,6 @@ std::unique_ptr falco_engine::load_rules(const std::string &rules_c // add rules to the engine and the rulesets for (const auto& rule : m_last_compile_output->rules) { - // skip the rule if below the minimum priority - if (rule.priority > m_min_priority) - { - continue; - } - auto info = m_rule_collector.rules().at(rule.name); if (!info) { @@ -200,11 +195,15 @@ std::unique_ptr falco_engine::load_rules(const std::string &rules_c auto source = find_source(rule.source); std::shared_ptr filter( sinsp_filter_compiler(source->filter_factory, rule.condition.get()).compile()); - auto rule_id = m_rules.insert(rule, rule.name); - m_rules.at(rule_id)->id = rule_id; + m_rules.insert(rule, rule.name); source->ruleset->add(rule, filter, rule.condition); // By default rules are enabled/disabled for the default ruleset + // skip the rule if below the minimum priority + if (rule.priority > m_min_priority) + { + continue; + } if(info->enabled) { source->ruleset->enable(rule.name, true, m_default_ruleset_id);