github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-19 17:16:53 +00:00
Code Issues Projects Releases Wiki Activity

Update README to always use local kernel module.

Browse Source 
Instead of suggesting using a kernel module from an installed version of
sysdig, always recommend unloading any existing module and using the
locally built one.
This commit is contained in:
Mark Stemm 2016-05-03 15:45:28 -07:00
parent 345452836b
commit dfa6da47a3
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
README.md
View File

@ -98,9 +98,15 @@ $ make
as a result, you should have a falco executable in `build/userspace/falco/falco`.
### (Optional) Install sysdig kernel driver
### Load latest sysdig kernel module
If you have a binary version of sysdig installed, the sysdig kernel module is already loaded and can be used by falco. Otherwise, you should load the kernel module from the sysdig source directory. Assuming you are in the `build` dir, you can install the kernel module via:
If you have a binary version of sysdig installed, an older sysdig kernel module may already be loaded. To ensure you are using the latest version, you should unload any existing sysdig kernel module and load the locally built version.
Unload any existing kernel module via:
`$ rmmod sysdig_probe`
To load the locally built version, assuming you are in the `build` dir, use:
`$ insmod driver/sysdig-probe.ko`