diff --git a/falco.yaml b/falco.yaml index 111ad4a8..e60ccb5f 100644 --- a/falco.yaml +++ b/falco.yaml @@ -170,6 +170,10 @@ syscall_event_drops: syscall_event_timeouts: max_consecutives: 1000 +# Enabling this option allows Falco to drop failed syscalls exit events. +# This can enable some small optimization both in CPU usage and ring buffer usage, +# possibly leading to lower number of event losses. +# Be careful: enabling it also means losing a bit of visibility on the system. syscall_drop_failed: false # --- [Description]