From f8f7e73a7f483fa19249d2ba6ab43718d7f79bc8 Mon Sep 17 00:00:00 2001 From: Federico Di Pierro Date: Fri, 24 Mar 2023 16:15:31 +0100 Subject: [PATCH] update(docs): properly document new option in config file. Signed-off-by: Federico Di Pierro --- falco.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/falco.yaml b/falco.yaml index 111ad4a8..e60ccb5f 100644 --- a/falco.yaml +++ b/falco.yaml @@ -170,6 +170,10 @@ syscall_event_drops: syscall_event_timeouts: max_consecutives: 1000 +# Enabling this option allows Falco to drop failed syscalls exit events. +# This can enable some small optimization both in CPU usage and ring buffer usage, +# possibly leading to lower number of event losses. +# Be careful: enabling it also means losing a bit of visibility on the system. syscall_drop_failed: false # --- [Description]