diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 1e0e370b..2cd30967 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -17,7 +17,7 @@
 #
 set(FALCO_TESTS_SOURCES
     test_base.cpp
-    engine/test_ruleset.cpp)
+    engine/test_token_bucket.cpp)
 
 set(FALCO_TESTED_LIBRARIES
     falco_engine)
diff --git a/tests/engine/test_ruleset.cpp b/tests/engine/test_ruleset.cpp
deleted file mode 100644
index 024b8106..00000000
--- a/tests/engine/test_ruleset.cpp
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
-Copyright (C) 2016-2019 Draios Inc dba Sysdig.
-
-This file is part of falco.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include <catch.hpp>
-#include "ruleset.h"
-
-TEST_CASE("vectors can be sized and resized", "[vector]")
-{
-    auto rs = new falco_ruleset();
-
-    SECTION("adding ...")
-    {
-        std::string s = "string";
-        std::set<std::string> tagset = {"a", "b", "c"};
-        std::set<uint32_t> evtset = {1, 2, 3};
-        rs->add(s, tagset, evtset, nullptr);
-    }
-
-    // std::vector<int> v(5);
-
-    // REQUIRE(v.size() == 5);
-    // REQUIRE(v.capacity() >= 5);
-
-    // SECTION("resizing bigger changes size and capacity")
-    // {
-    //     v.resize(10);
-
-    //     REQUIRE(v.size() == 10);
-    //     REQUIRE(v.capacity() >= 10);
-    // }
-    // SECTION("resizing smaller changes size but not capacity")
-    // {
-    //     v.resize(0);
-
-    //     REQUIRE(v.size() == 0);
-    //     REQUIRE(v.capacity() >= 5);
-    // }
-    // SECTION("reserving bigger changes capacity but not size")
-    // {
-    //     v.reserve(10);
-
-    //     REQUIRE(v.size() == 5);
-    //     REQUIRE(v.capacity() >= 10);
-    // }
-    // SECTION("reserving smaller does not change size or capacity")
-    // {
-    //     v.reserve(0);
-
-    //     REQUIRE(v.size() == 5);
-    //     REQUIRE(v.capacity() >= 5);
-    // }
-}
diff --git a/tests/engine/test_token_bucket.cpp b/tests/engine/test_token_bucket.cpp
new file mode 100644
index 00000000..553b1599
--- /dev/null
+++ b/tests/engine/test_token_bucket.cpp
@@ -0,0 +1,78 @@
+/*
+Copyright (C) 2016-2019 Draios Inc dba Sysdig.
+
+This file is part of falco.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+#include "token_bucket.h"
+#include <catch.hpp>
+
+using namespace Catch::literals;
+
+TEST_CASE("token bucket ctor", "[token_bucket]")
+{
+}
+
+TEST_CASE("token bucket init", "[token_bucket]")
+{
+    auto tb = new token_bucket();
+
+    SECTION("at specific time")
+    {
+	auto max = 2.0;
+	uint64_t now = 1;
+	tb->init(1.0, max, now);
+	REQUIRE(tb->get_last_seen() == now);
+	REQUIRE(tb->get_tokens() == max);
+    }
+
+    SECTION("at current time")
+    {
+	// auto max = 2.0;
+	// tb->init(1.0, max, 0);
+	// REQUIRE(tb->get_last_seen() == );
+	// REQUIRE(tb->get_tokens() == max);
+    }
+}
+
+TEST_CASE("token bucket claim", "[token_bucket]")
+{
+    auto tb = new token_bucket();
+    tb->init(2.0, 10.0, 1);
+
+    SECTION("...")
+    {
+	bool claimed = tb->claim(5.0, 1000000001);
+	REQUIRE(tb->get_last_seen() == 1000000001);
+	REQUIRE(tb->get_tokens() == 5.0_a);
+	REQUIRE(claimed);
+
+	SECTION("xxx")
+	{
+	    bool claimed = tb->claim(7.0, 2000000001);
+	    REQUIRE(tb->get_last_seen() == 2000000001);
+	    REQUIRE(tb->get_tokens() == 0.0_a);
+	    REQUIRE(claimed);
+
+	    SECTION(";;;")
+	    {
+		bool claimed = tb->claim(3.0, 3000000001);
+		REQUIRE(tb->get_last_seen() == 3000000001);
+		REQUIRE(tb->get_tokens() == 2.0_a);
+		REQUIRE_FALSE(claimed);
+	    }
+	}
+    }
+}
\ No newline at end of file