diff --git a/falco.yaml b/falco.yaml index 6fb19538..276fe251 100644 --- a/falco.yaml +++ b/falco.yaml @@ -72,7 +72,7 @@ buffered_outputs: false # full and system calls have been dropped, it can take one or more of # the following actions: # - ignore: do nothing (default when list of actions is empty) -# - log: log a CRITICAL message noting that the buffer was full +# - log: log a DEBUG message noting that the buffer was full # - alert: emit a Falco alert noting that the buffer was full # - exit: exit Falco with a non-zero rc # diff --git a/test/confs/drops_log.yaml b/test/confs/drops_log.yaml index 0e5df214..93908c4d 100644 --- a/test/confs/drops_log.yaml +++ b/test/confs/drops_log.yaml @@ -9,3 +9,5 @@ stdout_output: enabled: true log_stderr: true + +log_level: debug diff --git a/userspace/falco/falco.cpp b/userspace/falco/falco.cpp index fe8b73ac..5c0609c4 100644 --- a/userspace/falco/falco.cpp +++ b/userspace/falco/falco.cpp @@ -255,7 +255,7 @@ uint64_t do_inspect(falco_engine *engine, sdropmgr.init(inspector, outputs, config.m_syscall_evt_drop_actions, - config.m_syscall_evt_drop_threshold, + config.m_syscall_evt_drop_threshold, config.m_syscall_evt_drop_rate, config.m_syscall_evt_drop_max_burst, config.m_syscall_evt_simulate_drops);