From b2eb3ec34546d87004d49ca36355f2794fba422e Mon Sep 17 00:00:00 2001 From: Mark Stemm Date: Fri, 2 Oct 2020 16:52:44 -0700 Subject: [PATCH] Don't look for event counts with -V/validate When running falco with -V/valdiate , you won't get any event counts. All prior tests didn't get this far as they also resulted in rules parsing errors. However, validating can now result in warnings only. This won't exit but won't print event counts either. Signed-off-by: Mark Stemm --- test/falco_test.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/test/falco_test.py b/test/falco_test.py index f1fd1e2d..4cca0412 100644 --- a/test/falco_test.py +++ b/test/falco_test.py @@ -675,7 +675,8 @@ class FalcoTest(Test): self.check_rules_warnings(res) if len(self.rules_events) > 0: self.check_rules_events(res) - self.check_detections(res) + if len(self.validate_rules_file) == 0: + self.check_detections(res) if len(self.detect_counts) > 0: self.check_detections_by_rule(res) self.check_json_output(res)