From e3f1ac1be36a414982618958be99e3577b95efef Mon Sep 17 00:00:00 2001 From: Mark Stemm Date: Fri, 2 Oct 2020 16:52:44 -0700 Subject: [PATCH] Don't look for event counts with -V/validate When running falco with -V/valdiate , you won't get any event counts. All prior tests didn't get this far as they also resulted in rules parsing errors. However, validating can now result in warnings only. This won't exit but won't print event counts either. Signed-off-by: Mark Stemm --- test/falco_test.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/test/falco_test.py b/test/falco_test.py index 53f2bbb5..958baf44 100644 --- a/test/falco_test.py +++ b/test/falco_test.py @@ -585,7 +585,8 @@ class FalcoTest(Test): self.check_rules_warnings(res) if len(self.rules_events) > 0: self.check_rules_events(res) - self.check_detections(res) + if len(self.validate_rules_file) == 0: + self.check_detections(res) if len(self.detect_counts) > 0: self.check_detections_by_rule(res) self.check_json_output(res)