diff --git a/userspace/falco/app_actions/process_events.cpp b/userspace/falco/app_actions/process_events.cpp index d2d12703..74563919 100644 --- a/userspace/falco/app_actions/process_events.cpp +++ b/userspace/falco/app_actions/process_events.cpp @@ -330,6 +330,8 @@ application::run_result application::process_events() std::unique_ptr thread; }; + print_enabled_event_sources(); + // start event processing for all enabled sources std::vector ctxs; ctxs.reserve(m_state->enabled_sources.size()); diff --git a/userspace/falco/app_actions/select_event_sources.cpp b/userspace/falco/app_actions/select_event_sources.cpp index 2535766c..9b828883 100644 --- a/userspace/falco/app_actions/select_event_sources.cpp +++ b/userspace/falco/app_actions/select_event_sources.cpp @@ -15,6 +15,18 @@ limitations under the License. using namespace falco::app; +void application::print_enabled_event_sources() +{ + /* Print all enabled sources. */ + std::string str; + for (const auto &s : m_state->enabled_sources) + { + str += str.empty() ? "" : ", "; + str += s; + } + falco_logger::log(LOG_INFO, "Enabled event sources: " + str + "\n"); +} + application::run_result application::select_event_sources() { m_state->enabled_sources = m_state->loaded_sources; @@ -59,14 +71,5 @@ application::run_result application::select_event_sources() return run_result::fatal("Must enable at least one event source"); } - /* Print all enabled sources. */ - std::string result; - for (const auto &s : m_state->enabled_sources) - { - result += result.empty() ? "" : ", "; - result += s; - } - falco_logger::log(LOG_INFO, "Enabled event sources: " + result + "\n"); - return run_result::ok(); } \ No newline at end of file diff --git a/userspace/falco/application.h b/userspace/falco/application.h index 10b50b62..13bc3aaa 100644 --- a/userspace/falco/application.h +++ b/userspace/falco/application.h @@ -290,6 +290,7 @@ private: run_result open_offline_inspector(); run_result open_live_inspector(std::shared_ptr inspector, const std::string& source); void add_source_to_engine(const std::string& src); + void print_enabled_event_sources(); void init_syscall_inspector(std::shared_ptr inspector, const falco::app::cmdline_options& opts); run_result do_inspect( std::shared_ptr inspector,