docs: changelog for 0.26.2

Co-authored-by: Lorenzo Fontana <lo@linux.com> Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
update: new DRIVERS_REPO default
2026-03-20 11:42:06 +00:00 · 2020-11-10 10:34:10 +00:00 · 2020-11-10 10:28:03 +00:00
79 changed files with 1136 additions and 2088 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -282,8 +282,6 @@ jobs:
      - run:
          name: Execute integration tests
          command: /usr/bin/entrypoint test
-      - store_test_results:
-          path: /build/release/integration-tests-xunit
  "tests/integration-static":
    docker:
      - image: falcosecurity/falco-tester:latest
@@ -299,8 +297,6 @@ jobs:
      - run:
          name: Execute integration tests
          command: /usr/bin/entrypoint test
-      - store_test_results:
-          path: /build-static/release/integration-tests-xunit
  "tests/driver-loader/integration":
    machine:
      image: ubuntu-1604:202004-01
--- a/.github/stale.yml
+++ b/.github/stale.yml
@@ -0,0 +1,20 @@
+# Number of days of inactivity before an issue becomes stale
+daysUntilStale: 60
+# Number of days of inactivity before a stale issue is closed
+daysUntilClose: 7
+# Issues with these labels will never be considered stale
+exemptLabels:
+  - cncf
+  - roadmap
+  - "help wanted"
+# Label to use when marking an issue as stale
+staleLabel: wontfix
+# Comment to post when marking an issue as stale. Set to `false` to disable
+markComment: >
+  This issue has been automatically marked as stale because it has not had
+  recent activity. It will be closed if no further activity occurs. Thank you
+  for your contributions.
+  Issues labeled "cncf", "roadmap" and "help wanted" will not be automatically closed.
+  Please refer to a maintainer to get such label added if you think this should be kept open.
+# Comment to post when closing a stale issue. Set to `false` to disable
+closeComment: false
--- a/.gitignore
+++ b/.gitignore
@@ -11,6 +11,8 @@ test/.phoronix-test-suite
 test/results*.json.*
 test/build

+userspace/falco/lua/re.lua
+userspace/falco/lua/lpeg.so
 userspace/engine/lua/lyaml
 userspace/engine/lua/lyaml.lua

--- a/.luacheckrc
+++ b/.luacheckrc
@@ -1,6 +1,7 @@
 std = "min"
 cache = true
 include_files = {
+    "userspace/falco/lua/*.lua",
    "userspace/engine/lua/*.lua",
    "userspace/engine/lua/lyaml/*.lua",
    "*.luacheckrc"
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -19,15 +19,6 @@ option(BUILD_WARNINGS_AS_ERRORS "Enable building with -Wextra -Werror flags" OFF
 option(MINIMAL_BUILD "Build a minimal version of Falco, containing only the engine and basic input/output (EXPERIMENTAL)" OFF)
 option(MUSL_OPTIMIZED_BUILD "Enable if you want a musl optimized build" OFF)

-# We shouldn't need to set this, see https://gitlab.kitware.com/cmake/cmake/-/issues/16419
-option(EP_UPDATE_DISCONNECTED "ExternalProject update disconnected" OFF)
-if (${EP_UPDATE_DISCONNECTED})
-  set_property(
-    DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
-    PROPERTY EP_UPDATE_DISCONNECTED TRUE)
-endif()
-
-
 # Elapsed time
 # set_property(GLOBAL PROPERTY RULE_LAUNCH_COMPILE "${CMAKE_COMMAND} -E time") # TODO(fntlnz, leodido): add a flag to enable this

@@ -124,8 +115,20 @@ set(CURSES_NEED_NCURSES TRUE)
 find_package(Curses REQUIRED)
 message(STATUS "Found ncurses: include: ${CURSES_INCLUDE_DIR}, lib: ${CURSES_LIBRARIES}")

-# b64
-include(b64)
+# libb64
+
+set(B64_SRC "${PROJECT_BINARY_DIR}/b64-prefix/src/b64")
+message(STATUS "Using bundled b64 in '${B64_SRC}'")
+set(B64_INCLUDE "${B64_SRC}/include")
+set(B64_LIB "${B64_SRC}/src/libb64.a")
+ExternalProject_Add(
+  b64
+  URL "https://github.com/libb64/libb64/archive/v1.2.1.zip"
+  URL_HASH "SHA256=665134c2b600098a7ebd3d00b6a866cb34909a6d48e0e37a0eda226a4ad2638a"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND ${CMD_MAKE}
+  BUILD_IN_SOURCE 1
+  INSTALL_COMMAND "")

 # yaml-cpp
 include(yaml-cpp)
@@ -139,16 +142,52 @@ if(NOT MINIMAL_BUILD)
 endif()

 # LuaJIT
-include(luajit)
+set(LUAJIT_SRC "${PROJECT_BINARY_DIR}/luajit-prefix/src/luajit/src")
+message(STATUS "Using bundled LuaJIT in '${LUAJIT_SRC}'")
+set(LUAJIT_INCLUDE "${LUAJIT_SRC}")
+set(LUAJIT_LIB "${LUAJIT_SRC}/libluajit.a")
+ExternalProject_Add(
+  luajit
+  URL "https://github.com/LuaJIT/LuaJIT/archive/v2.0.3.tar.gz"
+  URL_HASH "SHA256=8da3d984495a11ba1bce9a833ba60e18b532ca0641e7d90d97fafe85ff014baa"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND ${CMD_MAKE}
+  BUILD_IN_SOURCE 1
+  INSTALL_COMMAND "")

 # Lpeg
-include(lpeg)
+set(LPEG_SRC "${PROJECT_BINARY_DIR}/lpeg-prefix/src/lpeg")
+set(LPEG_LIB "${PROJECT_BINARY_DIR}/lpeg-prefix/src/lpeg/build/lpeg.a")
+message(STATUS "Using bundled lpeg in '${LPEG_SRC}'")
+set(LPEG_DEPENDENCIES "")
+list(APPEND LPEG_DEPENDENCIES "luajit")
+ExternalProject_Add(
+  lpeg
+  DEPENDS ${LPEG_DEPENDENCIES}
+  URL "http://www.inf.puc-rio.br/~roberto/lpeg/lpeg-1.0.2.tar.gz"
+  URL_HASH "SHA256=48d66576051b6c78388faad09b70493093264588fcd0f258ddaab1cdd4a15ffe"
+  BUILD_COMMAND LUA_INCLUDE=${LUAJIT_INCLUDE} "${PROJECT_SOURCE_DIR}/scripts/build-lpeg.sh" "${LPEG_SRC}/build"
+  BUILD_IN_SOURCE 1
+  CONFIGURE_COMMAND ""
+  INSTALL_COMMAND "")

 # libyaml
 include(libyaml)

 # lyaml
-include(lyaml)
+set(LYAML_SRC "${PROJECT_BINARY_DIR}/lyaml-prefix/src/lyaml/ext/yaml")
+set(LYAML_LIB "${LYAML_SRC}/.libs/yaml.a")
+message(STATUS "Using bundled lyaml in '${LYAML_SRC}'")
+ExternalProject_Add(
+  lyaml
+  DEPENDS luajit libyaml
+  URL "https://github.com/gvvaughan/lyaml/archive/release-v6.0.tar.gz"
+  URL_HASH "SHA256=9d7cf74d776999ff6f758c569d5202ff5da1f303c6f4229d3b41f71cd3a3e7a7"
+  BUILD_COMMAND ${CMD_MAKE}
+  BUILD_IN_SOURCE 1
+  CONFIGURE_COMMAND ./configure --enable-static CFLAGS=-I${LIBYAML_INSTALL_DIR}/include CPPFLAGS=-I${LIBYAML_INSTALL_DIR}/include LDFLAGS=-L${LIBYAML_INSTALL_DIR}/lib LIBS=-lyaml LUA=${LUAJIT_SRC}/luajit LUA_INCLUDE=-I${LUAJIT_INCLUDE}
+  INSTALL_COMMAND sh -c
+                  "cp -R ${PROJECT_BINARY_DIR}/lyaml-prefix/src/lyaml/lib/* ${PROJECT_SOURCE_DIR}/userspace/engine/lua")

 # One TBB
 set(TBB_SRC "${PROJECT_BINARY_DIR}/tbb-prefix/src/tbb")
@@ -181,7 +220,6 @@ if(NOT MINIMAL_BUILD)
    COMMAND ${CMAKE_COMMAND} -E make_directory ${CIVETWEB_SRC}/install/include
    BUILD_IN_SOURCE 1
    BUILD_COMMAND ${CMD_MAKE} COPT="-DNO_FILES" WITH_CPP=1
-    BUILD_BYPRODUCTS ${CIVETWEB_LIB}
    INSTALL_COMMAND ${CMD_MAKE} COPT="-DNO_FILES" install-lib install-headers PREFIX=${CIVETWEB_SRC}/install "WITH_CPP=1")
 endif()

--- a/README.md
+++ b/README.md
@@ -3,11 +3,9 @@

 <hr>

-[![Build Status](https://img.shields.io/circleci/build/github/falcosecurity/falco/master?style=for-the-badge)](https://circleci.com/gh/falcosecurity/falco) [![CII Best Practices Summary](https://img.shields.io/cii/summary/2317?label=CCI%20Best%20Practices&style=for-the-badge)](https://bestpractices.coreinfrastructure.org/projects/2317) [![GitHub](https://img.shields.io/github/license/falcosecurity/falco?style=for-the-badge)](./COPYING)
+[![Build Status](https://img.shields.io/circleci/build/github/falcosecurity/falco/master?style=for-the-badge)](https://circleci.com/gh/falcosecurity/falco) [![CII Best Practices Summary](https://img.shields.io/cii/summary/2317?label=CCI%20Best%20Practices&style=for-the-badge)](https://bestpractices.coreinfrastructure.org/projects/2317) [![GitHub](https://img.shields.io/github/license/falcosecurity/falco?style=for-the-badge)](COPYING)

-Want to talk? Join us on the [#falco](https://kubernetes.slack.com/archives/CMWH3EH32) channel in the [Kubernetes Slack](https://slack.k8s.io).
-
-### Latest releases
+#### Latest releases

 Read the [change log](CHANGELOG.md).

@@ -33,15 +31,15 @@ If you would like to run Falco in **production** please adhere to the [official
 | Tool     | Link                                                                                       | Note                                                               |
 |----------|--------------------------------------------------------------------------------------------|--------------------------------------------------------------------|
 | Helm     | [Chart Repository](https://github.com/falcosecurity/charts/tree/master/falco#introduction) | The Falco community offers regular helm chart releases.            |
-| Minikube | [Tutorial](https://falco.org/docs/getting-started/third-party/#minikube)                                   | The Falco driver has been baked into minikube for easy deployment. |
-| Kind     | [Tutorial](https://falco.org/docs/getting-started/third-party/#kind)                                       | Running Falco with kind requires a driver on the host system.      |
-| GKE      | [Tutorial](https://falco.org/docs/getting-started/third-party/#gke)                                        | We suggest using the eBPF driver for running Falco on GKE.         |
+| Minikube | [Tutorial](https://falco.org/docs/third-party/#minikube)                                   | The Falco driver has been baked into minikube for easy deployment. |
+| Kind     | [Tutorial](https://falco.org/docs/third-party/#kind)                                       | Running Falco with kind requires a driver on the host system.      |
+| GKE      | [Tutorial](https://falco.org/docs/third-party/#gke)                                        | We suggest using the eBPF driver for running Falco on GKE.         |

 ### Developing

 Falco is designed to be extensible such that it can be built into cloud-native applications and infrastructure.

-Falco has a [gRPC](https://falco.org/docs/grpc/) endpoint and an API defined in [protobuf](https://github.com/falcosecurity/falco/blob/master/userspace/falco/outputs.proto).
+Falco has a [gRPC](https://falco.org/docs/grpc/) endpoint and an API defined in [protobuf](https://github.com/falcosecurity/falco/blob/update-readme/userspace/falco/outputs.proto).
 The Falco Project supports various SDKs for this endpoint.

 ##### SDKs
@@ -65,7 +63,6 @@ For example, Falco can easily detect incidents including but not limited to:
 - Unexpected read of a sensitive file, such as `/etc/shadow`.
 - A non-device file is written to `/dev`.
 - A standard system binary, such as `ls`, is making an outbound network connection.
- A privileged pod is started in a Kubernetes cluster.

 ### Documentation

@@ -75,13 +72,6 @@ The [Official Documentation](https://falco.org/docs/) is the best resource to le

 To get involved with The Falco Project please visit [the community repository](https://github.com/falcosecurity/community) to find more.

-How to reach out?
-
- - Join the #falco channel on the [Kubernetes Slack](https://slack.k8s.io)
- - [Join the Falco mailing list](https://lists.cncf.io/g/cncf-falco-dev)
- - [Read the Falco documentation](https://falco.org/docs/)
-
-
 ### Contributing

 See the [CONTRIBUTING.md](https://github.com/falcosecurity/.github/blob/master/CONTRIBUTING.md).
@@ -104,4 +94,4 @@ Falco is licensed to you under the [Apache 2.0](./COPYING) open source license.
 [3]: https://dl.bintray.com/falcosecurity/deb-dev/stable
 [4]: https://dl.bintray.com/falcosecurity/deb/stable
 [5]: https://dl.bintray.com/falcosecurity/bin-dev/x86_64
-[6]: https://dl.bintray.com/falcosecurity/bin/x86_64
+[6]: https://dl.bintray.com/falcosecurity/bin/x86_64
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -90,16 +90,6 @@ Now assume `x.y.z` is the new version.

 - Finally, publish the release!

-### 3. Update the meeting notes
-
-For each release we archive the meeting notes in git for historical purposes.
-
- - The notes from the Falco meetings can be [found here](https://hackmd.io/6sEAlInlSaGnLz2FnFz21A).
-    - Note: There may be other notes from working groups that can optionally be added as well as needed.
- - Add the entire content of the document to a new file in [github.com/falcosecurity/community/tree/master/meeting-notes](https://github.com/falcosecurity/community/tree/master/meeting-notes) as a new file labeled `release-x.y.z.md`
- - Open up a pull request with the new change.
-
-
 ## Post-Release tasks

 Announce the new release to the world!
--- a/cmake/modules/CPM.cmake
+++ b/cmake/modules/CPM.cmake
@@ -1,19 +0,0 @@
-set(CPM_DOWNLOAD_VERSION 0.27.2)
-
-if(CPM_SOURCE_CACHE)
-  set(CPM_DOWNLOAD_LOCATION "${CPM_SOURCE_CACHE}/cpm/CPM_${CPM_DOWNLOAD_VERSION}.cmake")
-elseif(DEFINED ENV{CPM_SOURCE_CACHE})
-  set(CPM_DOWNLOAD_LOCATION "$ENV{CPM_SOURCE_CACHE}/cpm/CPM_${CPM_DOWNLOAD_VERSION}.cmake")
-else()
-  set(CPM_DOWNLOAD_LOCATION "${CMAKE_BINARY_DIR}/cmake/CPM_${CPM_DOWNLOAD_VERSION}.cmake")
-endif()
-
-if(NOT (EXISTS ${CPM_DOWNLOAD_LOCATION}))
-  message(STATUS "Downloading CPM.cmake to ${CPM_DOWNLOAD_LOCATION}")
-  file(DOWNLOAD
-       https://github.com/TheLartians/CPM.cmake/releases/download/v${CPM_DOWNLOAD_VERSION}/CPM.cmake
-       ${CPM_DOWNLOAD_LOCATION}
-  )
-endif()
-
-include(${CPM_DOWNLOAD_LOCATION})
--- a/cmake/modules/CPackConfig.cmake
+++ b/cmake/modules/CPackConfig.cmake
@@ -30,15 +30,9 @@ if(NOT CPACK_GENERATOR)
 endif()

 message(STATUS "Using package generators: ${CPACK_GENERATOR}")
-message(STATUS "Package architecture: ${CMAKE_SYSTEM_PROCESSOR}")
-set(CPACK_DEBIAN_PACKAGE_SECTION "utils")

-if(${CMAKE_SYSTEM_PROCESSOR} STREQUAL "x86_64")
-  set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "amd64")
-endif()
-if(${CMAKE_SYSTEM_PROCESSOR} STREQUAL "aarch64")
-  set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "arm64")
-endif()
+set(CPACK_DEBIAN_PACKAGE_SECTION "utils")
+set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "amd64")
 set(CPACK_DEBIAN_PACKAGE_HOMEPAGE "https://www.falco.org")
 set(CPACK_DEBIAN_PACKAGE_DEPENDS "dkms (>= 2.1.0.0)")
 set(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA
--- a/cmake/modules/OpenSSL.cmake
+++ b/cmake/modules/OpenSSL.cmake
@@ -10,7 +10,6 @@
 # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
 # specific language governing permissions and limitations under the License.
 #
-mark_as_advanced(OPENSSL_BINARY)
 if(NOT USE_BUNDLED_DEPS)
  find_package(OpenSSL REQUIRED)
  message(STATUS "Found openssl: include: ${OPENSSL_INCLUDE_DIR}, lib: ${OPENSSL_LIBRARIES}")
@@ -21,8 +20,6 @@ if(NOT USE_BUNDLED_DEPS)
    message(STATUS "Found openssl: binary: ${OPENSSL_BINARY}")
  endif()
 else()
-  mark_as_advanced(OPENSSL_BUNDLE_DIR OPENSSL_INSTALL_DIR OPENSSL_INCLUDE_DIR
-    OPENSSL_LIBRARY_SSL OPENSSL_LIBRARY_CRYPTO)
  set(OPENSSL_BUNDLE_DIR "${PROJECT_BINARY_DIR}/openssl-prefix/src/openssl")
  set(OPENSSL_INSTALL_DIR "${OPENSSL_BUNDLE_DIR}/target")
  set(OPENSSL_INCLUDE_DIR "${PROJECT_BINARY_DIR}/openssl-prefix/src/openssl/include")
--- a/cmake/modules/b64.cmake
+++ b/cmake/modules/b64.cmake
@@ -1,27 +0,0 @@
-#
-# Copyright (C) 2020 The Falco Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations under the License.
-#
-
-set(B64_SRC "${PROJECT_BINARY_DIR}/b64-prefix/src/b64")
-message(STATUS "Using bundled b64 in '${B64_SRC}'")
-set(B64_INCLUDE "${B64_SRC}/include")
-set(B64_LIB "${B64_SRC}/src/libb64.a")
-externalproject_add(
-  b64
-  URL "https://github.com/libb64/libb64/archive/ce864b17ea0e24a91e77c7dd3eb2d1ac4175b3f0.tar.gz"
-  URL_HASH "SHA256=d07173e66f435e5c77dbf81bd9313f8d0e4a3b4edd4105a62f4f8132ba932811"
-  CONFIGURE_COMMAND ""
-  BUILD_COMMAND ${CMD_MAKE}
-  BUILD_IN_SOURCE 1
-  BUILD_BYPRODUCTS ${B64_LIB}
-  INSTALL_COMMAND ""
-)
--- a/cmake/modules/gRPC.cmake
+++ b/cmake/modules/gRPC.cmake
@@ -22,7 +22,6 @@ if(NOT USE_BUNDLED_DEPS)
  endif()

  # c-ares
-  mark_as_advanced(CARES_INCLUDE CARES_LIB)
  find_path(CARES_INCLUDE NAMES ares.h)
  find_library(CARES_LIB NAMES libcares.so)
  if(CARES_INCLUDE AND CARES_LIB)
@@ -32,7 +31,6 @@ if(NOT USE_BUNDLED_DEPS)
  endif()

  # protobuf
-  mark_as_advanced(PROTOC PROTOBUF_INCLUDE PROTOBUF_LIB)
  find_program(PROTOC NAMES protoc)
  find_path(PROTOBUF_INCLUDE NAMES google/protobuf/message.h)
  find_library(PROTOBUF_LIB NAMES libprotobuf.so)
@@ -45,7 +43,6 @@ if(NOT USE_BUNDLED_DEPS)
  endif()

  # gpr
-  mark_as_advanced(GPR_LIB)
  find_library(GPR_LIB NAMES gpr)

  if(GPR_LIB)
@@ -55,16 +52,12 @@ if(NOT USE_BUNDLED_DEPS)
  endif()

  # gRPC todo(fntlnz, leodido): check that gRPC version is greater or equal than 1.8.0
-  mark_as_advanced(GRPC_INCLUDE GRPC_SRC
-    GRPC_LIB GRPC_LIBS_ABSOLUTE  GRPCPP_LIB GRPC_CPP_PLUGIN)
  find_path(GRPCXX_INCLUDE NAMES grpc++/grpc++.h)
  if(GRPCXX_INCLUDE)
    set(GRPC_INCLUDE ${GRPCXX_INCLUDE})
-    unset(GRPCXX_INCLUDE CACHE)
  else()
    find_path(GRPCPP_INCLUDE NAMES grpcpp/grpcpp.h)
    set(GRPC_INCLUDE ${GRPCPP_INCLUDE})
-    unset(GRPCPP_INCLUDE CACHE)
    add_definitions(-DGRPC_INCLUDE_IS_GRPCPP=1)
  endif()
  find_library(GRPC_LIB NAMES grpc)
@@ -122,7 +115,7 @@ else()
    grpc
    DEPENDS openssl
    GIT_REPOSITORY https://github.com/grpc/grpc.git
-    GIT_TAG v1.32.0
+    GIT_TAG v1.31.1
    GIT_SUBMODULES "third_party/protobuf third_party/zlib third_party/cares/cares third_party/abseil-cpp third_party/re2"
    BUILD_IN_SOURCE 1
    BUILD_BYPRODUCTS ${GRPC_LIB} ${GRPCPP_LIB}
--- a/cmake/modules/jq.cmake
+++ b/cmake/modules/jq.cmake
@@ -10,7 +10,6 @@
 # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
 # specific language governing permissions and limitations under the License.
 #
-mark_as_advanced(JQ_INCLUDE JQ_LIB)
 if (NOT USE_BUNDLED_DEPS)
    find_path(JQ_INCLUDE jq.h PATH_SUFFIXES jq)
    find_library(JQ_LIB NAMES jq)
--- a/cmake/modules/libyaml.cmake
+++ b/cmake/modules/libyaml.cmake
@@ -15,13 +15,12 @@ set(LIBYAML_SRC "${PROJECT_BINARY_DIR}/libyaml-prefix/src/libyaml")
 set(LIBYAML_INSTALL_DIR "${LIBYAML_SRC}/target")
 message(STATUS "Using bundled libyaml in '${LIBYAML_SRC}'")
 set(LIBYAML_LIB "${LIBYAML_SRC}/src/.libs/libyaml.a")
-externalproject_add(
-  libyaml
-  URL "https://github.com/yaml/libyaml/releases/download/0.2.5/yaml-0.2.5.tar.gz"
-  URL_HASH "SHA256=c642ae9b75fee120b2d96c712538bd2cf283228d2337df2cf2988e3c02678ef4"
-  CONFIGURE_COMMAND ./configure --prefix=${LIBYAML_INSTALL_DIR} CFLAGS=-fPIC CPPFLAGS=-fPIC --enable-static=true --enable-shared=false
-  BUILD_COMMAND ${CMD_MAKE}
-  BUILD_IN_SOURCE 1
-  BUILD_BYPRODUCTS ${LIBYAML_LIB}
-  INSTALL_COMMAND ${CMD_MAKE} install
-)
+ExternalProject_Add(
+libyaml
+URL "https://github.com/yaml/libyaml/releases/download/0.2.5/yaml-0.2.5.tar.gz"
+URL_HASH "SHA256=c642ae9b75fee120b2d96c712538bd2cf283228d2337df2cf2988e3c02678ef4"
+CONFIGURE_COMMAND ./configure --prefix=${LIBYAML_INSTALL_DIR} CFLAGS=-fPIC CPPFLAGS=-fPIC --enable-static=true --enable-shared=false
+BUILD_COMMAND ${CMD_MAKE} 
+BUILD_IN_SOURCE 1
+INSTALL_COMMAND ${CMD_MAKE} install)
+
--- a/cmake/modules/lpeg.cmake
+++ b/cmake/modules/lpeg.cmake
@@ -1,28 +0,0 @@
-#
-# Copyright (C) 2020 The Falco Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations under the License.
-#
-
-set(LPEG_SRC "${PROJECT_BINARY_DIR}/lpeg-prefix/src/lpeg")
-set(LPEG_LIB "${PROJECT_BINARY_DIR}/lpeg-prefix/src/lpeg/build/lpeg.a")
-message(STATUS "Using bundled lpeg in '${LPEG_SRC}'")
-set(LPEG_DEPENDENCIES "")
-list(APPEND LPEG_DEPENDENCIES "luajit")
-ExternalProject_Add(
-  lpeg
-  DEPENDS ${LPEG_DEPENDENCIES}
-  URL "http://www.inf.puc-rio.br/~roberto/lpeg/lpeg-1.0.2.tar.gz"
-  URL_HASH "SHA256=48d66576051b6c78388faad09b70493093264588fcd0f258ddaab1cdd4a15ffe"
-  BUILD_COMMAND LUA_INCLUDE=${LUAJIT_INCLUDE} "${PROJECT_SOURCE_DIR}/scripts/build-lpeg.sh" "${LPEG_SRC}/build"
-  BUILD_IN_SOURCE 1
-  BUILD_BYPRODUCTS ${LPEG_LIB}
-  CONFIGURE_COMMAND ""
-  INSTALL_COMMAND "")
--- a/cmake/modules/luajit.cmake
+++ b/cmake/modules/luajit.cmake
@@ -1,27 +0,0 @@
-#
-# Copyright (C) 2020 The Falco Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations under the License.
-#
-
-set(LUAJIT_SRC "${PROJECT_BINARY_DIR}/luajit-prefix/src/luajit/src")
-message(STATUS "Using bundled LuaJIT in '${LUAJIT_SRC}'")
-set(LUAJIT_INCLUDE "${LUAJIT_SRC}")
-set(LUAJIT_LIB "${LUAJIT_SRC}/libluajit.a")
-externalproject_add(
-  luajit
-  GIT_REPOSITORY "https://github.com/LuaJIT/LuaJIT"
-  GIT_TAG "1d8b747c161db457e032a023ebbff511f5de5ec2"
-  CONFIGURE_COMMAND ""
-  BUILD_COMMAND ${CMD_MAKE}
-  BUILD_IN_SOURCE 1
-  BUILD_BYPRODUCTS ${LUAJIT_LIB}
-  INSTALL_COMMAND ""
-)
--- a/cmake/modules/lyaml.cmake
+++ b/cmake/modules/lyaml.cmake
@@ -1,28 +0,0 @@
-#
-# Copyright (C) 2020 The Falco Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations under the License.
-#
-
-set(LYAML_SRC "${PROJECT_BINARY_DIR}/lyaml-prefix/src/lyaml/ext/yaml")
-set(LYAML_LIB "${LYAML_SRC}/.libs/yaml.a")
-message(STATUS "Using bundled lyaml in '${LYAML_SRC}'")
-externalproject_add(
-  lyaml
-  DEPENDS luajit libyaml
-  URL "https://github.com/gvvaughan/lyaml/archive/release-v6.0.tar.gz"
-  URL_HASH "SHA256=9d7cf74d776999ff6f758c569d5202ff5da1f303c6f4229d3b41f71cd3a3e7a7"
-  BUILD_COMMAND ${CMD_MAKE}
-  BUILD_IN_SOURCE 1
-  BUILD_BYPRODUCTS ${LYAML_LIB}
-  CONFIGURE_COMMAND ./configure --enable-static CFLAGS=-I${LIBYAML_INSTALL_DIR}/include CPPFLAGS=-I${LIBYAML_INSTALL_DIR}/include LDFLAGS=-L${LIBYAML_INSTALL_DIR}/lib LIBS=-lyaml LUA=${LUAJIT_SRC}/luajit LUA_INCLUDE=-I${LUAJIT_INCLUDE}
-  INSTALL_COMMAND sh -c
-  "cp -R ${PROJECT_BINARY_DIR}/lyaml-prefix/src/lyaml/lib/* ${PROJECT_SOURCE_DIR}/userspace/engine/lua"
-)
--- a/cmake/modules/static-analysis.cmake
+++ b/cmake/modules/static-analysis.cmake
@@ -3,7 +3,6 @@ file(MAKE_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/static-analysis-reports)
 file(MAKE_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/static-analysis-reports/cppcheck)

 # cppcheck
-mark_as_advanced(CPPCHECK CPPCHECK_HTMLREPORT)
 find_program(CPPCHECK cppcheck)
 find_program(CPPCHECK_HTMLREPORT cppcheck-htmlreport)

--- a/cmake/modules/sysdig-repo/CMakeLists.txt
+++ b/cmake/modules/sysdig-repo/CMakeLists.txt
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2020 The Falco Authors.
+# Copyright (C) 2019 The Falco Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 # the License. You may obtain a copy of the License at
@@ -25,4 +25,4 @@ ExternalProject_Add(
  BUILD_COMMAND ""
  INSTALL_COMMAND ""
  TEST_COMMAND ""
-  PATCH_COMMAND patch -p1 -i ${CMAKE_CURRENT_SOURCE_DIR}/patch/libscap.patch && patch -p1 -i ${CMAKE_CURRENT_SOURCE_DIR}/patch/luajit.patch)
+  PATCH_COMMAND patch -p1 -i ${CMAKE_CURRENT_SOURCE_DIR}/patch/libscap.patch)
--- a/cmake/modules/sysdig-repo/patch/libscap.patch
+++ b/cmake/modules/sysdig-repo/patch/libscap.patch
@@ -1,8 +1,8 @@
 diff --git a/userspace/libscap/scap.c b/userspace/libscap/scap.c
-index 6f51588e..5f9ea84e 100644
+index e9faea51..a1b3b501 100644
 --- a/userspace/libscap/scap.c
 +++ b/userspace/libscap/scap.c
-@@ -55,7 +55,7 @@ limitations under the License.
+@@ -52,7 +52,7 @@ limitations under the License.
 //#define NDEBUG
 #include <assert.h>
 
@@ -11,16 +11,7 @@ index 6f51588e..5f9ea84e 100644
 
 //
 // Probe version string size
-@@ -114,7 +114,7 @@ scap_t* scap_open_udig_int(char *error, int32_t *rc,
- static uint32_t get_max_consumers()
- {
- 	uint32_t max;
-	FILE *pfile = fopen("/sys/module/" PROBE_DEVICE_NAME "_probe/parameters/max_consumers", "r");
-+	FILE *pfile = fopen("/sys/module/" PROBE_DEVICE_NAME "/parameters/max_consumers", "r");
- 	if(pfile != NULL)
- 	{
- 		int w = fscanf(pfile, "%"PRIu32, &max);
-@@ -186,7 +186,7 @@ scap_t* scap_open_live_int(char *error, int32_t *rc,
+@@ -171,7 +171,7 @@ scap_t* scap_open_live_int(char *error, int32_t *rc,
 				return NULL;
 			}
 
@@ -29,27 +20,7 @@ index 6f51588e..5f9ea84e 100644
 			bpf_probe = buf;
 		}
 	}
-@@ -344,7 +344,7 @@ scap_t* scap_open_live_int(char *error, int32_t *rc,
- 				else if(errno == EBUSY)
- 				{
- 					uint32_t curr_max_consumers = get_max_consumers();
-					snprintf(error, SCAP_LASTERR_SIZE, "Too many sysdig instances attached to device %s. Current value for /sys/module/" PROBE_DEVICE_NAME "_probe/parameters/max_consumers is '%"PRIu32"'.", filename, curr_max_consumers);
-+					snprintf(error, SCAP_LASTERR_SIZE, "Too many Falco instances attached to device %s. Current value for /sys/module/" PROBE_DEVICE_NAME "/parameters/max_consumers is '%"PRIu32"'.", filename, curr_max_consumers);
- 				}
- 				else
- 				{
-@@ -579,8 +579,8 @@ scap_t* scap_open_udig_int(char *error, int32_t *rc,
- 	//
- 	// Map the ppm_ring_buffer_info that contains the buffer pointers
- 	//
-	if(udig_alloc_ring_descriptors(&(handle->m_devs[0].m_bufinfo_fd), 
-		&handle->m_devs[0].m_bufinfo, 
-+	if(udig_alloc_ring_descriptors(&(handle->m_devs[0].m_bufinfo_fd),
-+		&handle->m_devs[0].m_bufinfo,
- 		&handle->m_devs[0].m_bufstatus,
- 		error) != SCAP_SUCCESS)
- 	{
-@@ -2175,7 +2175,7 @@ int32_t scap_disable_dynamic_snaplen(scap_t* handle)
+@@ -1808,7 +1808,7 @@ int32_t scap_disable_dynamic_snaplen(scap_t* handle)
 
 const char* scap_get_host_root()
 {
--- a/cmake/modules/sysdig-repo/patch/luajit.patch
+++ b/cmake/modules/sysdig-repo/patch/luajit.patch
@@ -1,57 +0,0 @@
-diff --git a/userspace/libsinsp/chisel.cpp b/userspace/libsinsp/chisel.cpp
-index 0a6e3cf8..0c2e255a 100644
--- a/userspace/libsinsp/chisel.cpp
-+++ b/userspace/libsinsp/chisel.cpp
-@@ -98,7 +98,7 @@ void lua_stackdump(lua_State *L)
- // Lua callbacks
- ///////////////////////////////////////////////////////////////////////////////
- #ifdef HAS_LUA_CHISELS
-const static struct luaL_reg ll_sysdig [] =
-+const static struct luaL_Reg ll_sysdig [] =
- {
- 	{"set_filter", &lua_cbacks::set_global_filter},
- 	{"set_snaplen", &lua_cbacks::set_snaplen},
-@@ -134,7 +134,7 @@ const static struct luaL_reg ll_sysdig [] =
- 	{NULL,NULL}
- };
- 
-const static struct luaL_reg ll_chisel [] =
-+const static struct luaL_Reg ll_chisel [] =
- {
- 	{"request_field", &lua_cbacks::request_field},
- 	{"set_filter", &lua_cbacks::set_filter},
-@@ -146,7 +146,7 @@ const static struct luaL_reg ll_chisel [] =
- 	{NULL,NULL}
- };
- 
-const static struct luaL_reg ll_evt [] =
-+const static struct luaL_Reg ll_evt [] =
- {
- 	{"field", &lua_cbacks::field},
- 	{"get_num", &lua_cbacks::get_num},
-diff --git a/userspace/libsinsp/lua_parser.cpp b/userspace/libsinsp/lua_parser.cpp
-index 0e26617d..78810d96 100644
--- a/userspace/libsinsp/lua_parser.cpp
-+++ b/userspace/libsinsp/lua_parser.cpp
-@@ -32,7 +32,7 @@ extern "C" {
- #include "lauxlib.h"
- }
- 
-const static struct luaL_reg ll_filter [] =
-+const static struct luaL_Reg ll_filter [] =
- {
- 	{"rel_expr", &lua_parser_cbacks::rel_expr},
- 	{"bool_op", &lua_parser_cbacks::bool_op},
-diff --git a/userspace/libsinsp/lua_parser_api.cpp b/userspace/libsinsp/lua_parser_api.cpp
-index c89e9126..c3d8008a 100644
--- a/userspace/libsinsp/lua_parser_api.cpp
-+++ b/userspace/libsinsp/lua_parser_api.cpp
-@@ -266,7 +266,7 @@ int lua_parser_cbacks::rel_expr(lua_State *ls)
- 					string err = "Got non-table as in-expression operand\n";
- 					throw sinsp_exception("parser API error");
- 				}
-				int n = luaL_getn(ls, 4);  /* get size of table */
-+				int n = lua_objlen (ls, 4);  /* get size of table */
- 				for (i=1; i<=n; i++)
- 				{
- 					lua_rawgeti(ls, 4, i);
--- a/cmake/modules/sysdig.cmake
+++ b/cmake/modules/sysdig.cmake
@@ -29,8 +29,8 @@ file(MAKE_DIRECTORY ${SYSDIG_CMAKE_WORKING_DIR})
 # default below In case you want to test against another sysdig version just pass the variable - ie., `cmake
 # -DSYSDIG_VERSION=dev ..`
 if(NOT SYSDIG_VERSION)
-  set(SYSDIG_VERSION "5c0b863ddade7a45568c0ac97d037422c9efb750")
-  set(SYSDIG_CHECKSUM "SHA256=9de717b3a4b611ea6df56afee05171860167112f74bb7717b394bcc88ac843cd")
+  set(SYSDIG_VERSION "2aa88dcf6243982697811df4c1b484bcbe9488a2")
+  set(SYSDIG_CHECKSUM "SHA256=a737077543a6f3473ab306b424bcf7385d788149829ed1538252661b0f20d0f6")
 endif()
 set(PROBE_VERSION "${SYSDIG_VERSION}")

@@ -57,7 +57,6 @@ add_subdirectory("${SYSDIG_SOURCE_DIR}/driver" "${PROJECT_BINARY_DIR}/driver")
 # Add libscap directory
 add_definitions(-D_GNU_SOURCE)
 add_definitions(-DHAS_CAPTURE)
-add_definitions(-DNOCURSESUI)
 if(MUSL_OPTIMIZED_BUILD)
  add_definitions(-DMUSL_OPTIMIZED)
 endif()
--- a/cmake/modules/yaml-cpp.cmake
+++ b/cmake/modules/yaml-cpp.cmake
@@ -10,7 +10,6 @@
 # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
 # specific language governing permissions and limitations under the License.
 #
-mark_as_advanced(YAMLCPP_INCLUDE_DIR YAMLCPP_LIB)
 if(NOT USE_BUNDLED_DEPS)
  find_path(YAMLCPP_INCLUDE_DIR NAMES yaml-cpp/yaml.h)
  find_library(YAMLCPP_LIB NAMES yaml-cpp)
--- a/docker/driver-loader/Dockerfile
+++ b/docker/driver-loader/Dockerfile
@@ -3,7 +3,7 @@ FROM falcosecurity/falco:${FALCO_IMAGE_TAG}

 LABEL maintainer="cncf-falco-dev@lists.cncf.io"

-LABEL usage="docker run -i -t --privileged -v /root/.falco:/root/.falco -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc:ro --name NAME IMAGE"
+LABEL usage="docker run -i -t -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro --name NAME IMAGE"

 ENV HOST_ROOT /host
 ENV HOME /root
--- a/docker/falco/Dockerfile
+++ b/docker/falco/Dockerfile
@@ -2,7 +2,7 @@ FROM debian:stable

 LABEL maintainer="cncf-falco-dev@lists.cncf.io"

-LABEL usage="docker run -i -t --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro -v /etc:/host/etc --name NAME IMAGE"
+LABEL usage="docker run -i -t -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro --name NAME IMAGE"

 ARG FALCO_VERSION=latest
 ARG VERSION_BUCKET=deb
--- a/docker/no-driver/Dockerfile
+++ b/docker/no-driver/Dockerfile
@@ -1,5 +1,7 @@
 FROM ubuntu:18.04 as ubuntu

+LABEL maintainer="cncf-falco-dev@lists.cncf.io"
+
 ARG FALCO_VERSION
 ARG VERSION_BUCKET=bin

@@ -20,14 +22,6 @@ RUN sed -e 's/time_format_iso_8601: false/time_format_iso_8601: true/' < /falco/

 FROM scratch

-LABEL maintainer="cncf-falco-dev@lists.cncf.io"
-
-LABEL usage="docker run -i -t --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro --name NAME IMAGE"
-# NOTE: for the "least privileged" use case, please refer to the official documentation
-
-ENV HOST_ROOT /host
-ENV HOME /root
-
 COPY --from=ubuntu /falco /

 CMD ["/usr/bin/falco", "-o", "time_format_iso_8601=true"]
--- a/docker/tester/root/usr/bin/entrypoint
+++ b/docker/tester/root/usr/bin/entrypoint
@@ -1,5 +1,7 @@
 #!/usr/bin/env bash

+set -u -o pipefail
+
 BUILD_DIR=${BUILD_DIR:-/build}
 SOURCE_DIR=${SOURCE_DIR:-/source}
 SKIP_PACKAGES_TESTS=${SKIP_PACKAGES_TESTS:-false}
@@ -7,9 +9,6 @@ SKIP_PACKAGES_TESTS=${SKIP_PACKAGES_TESTS:-false}
 CMD=${1:-test}
 shift

-# Stop the execution if a command in the pipeline has an error, from now on
-set -e -u -o pipefail
-
 # build type can be "debug" or "release", fallbacks to "release" by default
 BUILD_TYPE=$(echo "$BUILD_TYPE" | tr "[:upper:]" "[:lower:]")
 case "$BUILD_TYPE" in
@@ -50,8 +49,7 @@ case "$CMD" in
 "test")
    if [ -z "$FALCO_VERSION" ]; then
        echo "Automatically figuring out Falco version."
-        FALCO_VERSION_FULL=$("$BUILD_DIR/$BUILD_TYPE/userspace/falco/falco" --version)
-        FALCO_VERSION=$(echo "$FALCO_VERSION_FULL" | head -n 1 | cut -d' ' -f3  | tr -d '\r')
+        FALCO_VERSION=$("$BUILD_DIR/$BUILD_TYPE/userspace/falco/falco" --version | head -n 1 | cut -d' ' -f3 | tr -d '\r')
        echo "Falco version: $FALCO_VERSION"
    fi
    if [ -z "$FALCO_VERSION" ]; then
--- a/documentation/CMakeLists.txt
+++ b/documentation/CMakeLists.txt
@@ -1,35 +0,0 @@
-cmake_minimum_required(VERSION 3.14 FATAL_ERROR)
-
-project(FalcoDocs)
-
-# Dependencies
-
-include(../cmake/modules/CPM.cmake)
-
-CPMAddPackage(NAME Falco SOURCE_DIR ${CMAKE_CURRENT_LIST_DIR}/..)
-
-CPMAddPackage(
-  NAME MCSS
-  DOWNLOAD_ONLY YES
-  GITHUB_REPOSITORY mosra/m.css
-  GIT_TAG 42d4a9a48f31f5df6e246c948403b54b50574a2a
-)
-
-# Doxygen variables
-
-set(DOXYGEN_PROJECT_NAME Falco)
-set(DOXYGEN_PROJECT_VERSION ${FALCO_VERSION})
-set(DOXYGEN_PROJECT_ROOT "${CMAKE_CURRENT_LIST_DIR}/..")
-set(DOXYGEN_OUTPUT_DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}/doxygen")
-
-configure_file(${CMAKE_CURRENT_LIST_DIR}/Doxyfile ${CMAKE_CURRENT_BINARY_DIR}/Doxyfile)
-
-configure_file(${CMAKE_CURRENT_LIST_DIR}/conf.py ${CMAKE_CURRENT_BINARY_DIR}/conf.py)
-
-add_custom_target(
-  GenerateDocs
-  ${CMAKE_COMMAND} -E make_directory "${DOXYGEN_OUTPUT_DIRECTORY}"
-  COMMAND "${MCSS_SOURCE_DIR}/documentation/doxygen.py" "${CMAKE_CURRENT_BINARY_DIR}/conf.py"
-  COMMAND echo "Docs written to: ${DOXYGEN_OUTPUT_DIRECTORY}"
-  WORKING_DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}"
-)
--- a/documentation/Doxyfile
+++ b/documentation/Doxyfile
@@ -1,31 +0,0 @@
-# Configuration for Doxygen for use with CMake
-# Only options that deviate from the default are included
-# To create a new Doxyfile containing all available options, call `doxygen -g`
-
-# Get Project name and version from CMake
-PROJECT_NAME = @DOXYGEN_PROJECT_NAME@
-PROJECT_NUMBER = @DOXYGEN_PROJECT_VERSION@
-
-# Add sources
-INPUT = @DOXYGEN_PROJECT_ROOT@/README.md @DOXYGEN_PROJECT_ROOT@/userspace @DOXYGEN_PROJECT_ROOT@/documentation/pages
-EXTRACT_ALL = YES
-RECURSIVE = YES
-OUTPUT_DIRECTORY = @DOXYGEN_OUTPUT_DIRECTORY@
-
-# Use the README as a main page
-USE_MDFILE_AS_MAINPAGE = @DOXYGEN_PROJECT_ROOT@/README.md
-
-# Set relative include paths
-FULL_PATH_NAMES = YES
-STRIP_FROM_PATH = @DOXYGEN_PROJECT_ROOT@/userspace @DOXYGEN_PROJECT_ROOT@
-
-# We only need XML output because use m.css to generate the html documentation
-GENERATE_XML = YES
-GENERATE_HTML = NO
-GENERATE_LATEX = NO
-XML_PROGRAMLISTING = NO
-CREATE_SUBDIRS = NO
-
-# Include all directories, files and namespaces in the documentation
-# Disable to include only explicitly documented objects
-M_SHOW_UNDOCUMENTED = YES
--- a/documentation/conf.py
+++ b/documentation/conf.py
@@ -1,19 +0,0 @@
-DOXYFILE = 'Doxyfile'
-
-LINKS_NAVBAR1 = [
-    (None, 'pages', [(None, 'about')]),
-    (None, 'namespaces', []),
-]
-
-# Add your own navbar links using the code below.
-# To find the valid link names, you can inspect the URL of a generated documentation site.
-
-# LINKS_NAVBAR1 = [
-#     (None, 'pages', [(None, 'about')]),
-#     (None, 'namespaces', [(None, 'namespacexyz')]),
-# ]
-#
-# LINKS_NAVBAR2 = [
-#     (None, 'annotated', [(None, 'classxyz_1_1_xyz')]),
-#     (None, 'files', [(None, 'xyz_8h')]),
-# ]
--- a/documentation/pages/about.dox
+++ b/documentation/pages/about.dox
@@ -1,4 +0,0 @@
-/** @page about About
-  @section doc Falco Documentation
-  This is the documentation for the Falco project.
-*/
--- a/falco.yaml
+++ b/falco.yaml
@@ -87,23 +87,6 @@ syscall_event_drops:
  rate: .03333
  max_burst: 10

-# Falco continuously monitors outputs performance. When an output channel does not allow
-# to deliver an alert within a given deadline, an error is reported indicating
-# which output is blocking notifications.
-# The timeout error will be reported to the log according to the above log_* settings.
-# Note that the notification will not be discarded from the output queue; thus,
-# output channels may indefinitely remain blocked.
-# An output timeout error indeed indicate a misconfiguration issue or I/O problems
-# that cannot be recovered by Falco and should be fixed by the user.
-#
-# The "output_timeout" value specifies the duration in milliseconds to wait before
-# considering the deadline exceed.
-#
-# With a 2000ms default, the notification consumer can block the Falco output
-# for up to 2 seconds without reaching the timeout.
-
-output_timeout: 2000
-
 # A throttling mechanism implemented as a token bucket limits the
 # rate of falco notifications. This throttling is controlled by the following configuration
 # options:
--- a/proposals/20201025-drivers-storage-s3.md
+++ b/proposals/20201025-drivers-storage-s3.md
@@ -1,137 +0,0 @@
-# Falco Drivers Storage S3
-
-Supersedes: [20200818-artifacts-storage.md#drivers](20200818-artifacts-storage.md#drivers)
-
-Supersedes: [20200901-artifacts-cleanup.md#drivers](20200901-artifacts-cleanup.md#drivers)
-
-## Introduction
-
-In the past days, as many people probably noticed, Bintray started rate-limiting our users, effectively preventing them from downloading any kernel module, rpm/deb package or any pre-built dependency we host there.
-
-This does not only interrupt the workflow of our users but also the workflow of the contributors, since without bintray most of our container images and CMake files can’t download the dependencies we mirror.
-
-### What is the cause?
-
-We had a spike in adoption apparently, either a user with many nodes or an increased number of users. We don’t know this detail specifically yet because bintray does not give us very fine-grained statistics on this.
-
-This is the 30-days history:
-
-![A spike on driver downloads the last ten days](20201025-drivers-storage-s3_downloads.png)
-
-As you can see, we can only see that they downloaded the latest kernel module driver version, however we can’t see if:
-
-* It’s a single source or many different users
-
-* What is the kernel/OS they are using
-
-### What do we host on Bintray?
-
-* RPM packages: high traffic but very manageable ~90k downloads a month
-
-* Deb packages:low traffic ~5k downloads a month
-
-* Pre-built image Dependencies: low traffic, will eventually disappear in the future
-
-* Kernel modules: very high traffic, 700k downloads in 10 days, this is what is causing the current problems. They are primarily used by users of our container images.
-
-* eBPF probes: low traffic ~5k downloads a month
-
-### Motivations to go to S3 instead of Bintray for the Drivers
-
-Bintray does an excellent service at building the rpm/deb structures for us, however we also use them for S3-like storage for the drivers. We have ten thousand files hosted there and the combinations are infinite.
-
-
-Before today, we had many issues with storage even without the spike in users we are seeing since the last ten days.
-
-## Context on AWS
-
-Amazon AWS, recently gave credits to the Falco project to operate some parts of the infrastructure on AWS. The CNCF is providing a sub-account we are already using for the migration of the other pieces (like Prow).
-
-## Interactions with other teams and the CNCF
-
-* The setup on the AWS account side already done, this is all technical work.
-
-* We need to open a CNCF service account ticket for the download.falco.org subdomain to point to the S3 bucket we want to use
-
-## The Plan
-
-We want to propose to move the drivers and the container dependencies to S3.
-
-#### Moving means:
-
-* We create a public S3 bucket with [stats enabled](https://docs.aws.amazon.com/AmazonS3/latest/dev/analytics-storage-class.html)
-
-* We attach the bucket to a cloudfront distribution behind the download.falco.org subdomain
-
-* We move the current content keeping the same web server directory structure
-
-* We change the Falco Dockerfiles and driver loader script accordingly
-
-* We update test-infra to push the drivers to S3
-
-* Once we have the drivers in S3, we can ask bintray to relax the limits for this month so that our users are able to download the other packages we keep there. Otherwise they will have to wait until November 1st. We only want to do that after the moving because otherwise we will hit the limits pretty quickly.
-
-#### The repositories we want to move are:
-
-* [https://bintray.com/falcosecurity/driver](https://bintray.com/falcosecurity/driver) will become https://download.falco.org/driver
-
-* [https://bintray.com/falcosecurity/dependencies](https://bintray.com/falcosecurity/dependencies) will become https://download.falco.org/dependencies
-
-#### Changes in Falco
-
-* [Search for bintray ](https://github.com/falcosecurity/falco/search?p=2&q=bintray)on the Falco repo and replace the URL for the CMake and Docker files.
-
-* It’s very important to change the DRIVERS_REPO environment variable [here](https://github.com/falcosecurity/falco/blob/0a33f555eb8e019806b46fea8b80a6302a935421/CMakeLists.txt#L86) - this is what updates the falco-driver-loader scripts that the users and container images use to fetch the module
-
-#### Changes in Test Infra
-
-* We need to use the S3 cli instead of jfrog cli to upload to the s3 bucket after building [here](https://github.com/falcosecurity/test-infra/blob/master/.circleci/config.yml)
-
-* We can probably remove jfrog from that repo since it only deals with drivers and drivers are being put on S3 now
-
-* Instructions on how to setup the S3 directory structure [here](https://falco.org/docs/installation/#install-driver)
-
-    * `/$driver_version$/falco_$target$_$kernelrelease$_$kernelversion$.[ko|o]`
-
-#### Changes to Falco website
-
-* Changes should not be necessary, we are not updating the way people install Falco but only the driver. The driver is managed by a script we can change.
-
-## Mitigation and next steps for the users
-
-* **The average users should be good to go now, Bintray raised our limits and we have some room to do this without requiring manual steps on your end**
-
-* **Users that can’t wait for us to have the S3 setup done: **can setup an S3 as driver repo themselves, push the drivers they need to it after compiling them (they can use [Driverkit](https://github.com/falcosecurity/driverkit) for that) Instructions on how to setup the S3 directory structure [here](https://falco.org/docs/installation/#install-driver).
-
-* **Users that can’t wait but don’t want to setup a webserver themselves**: the falco-driver-loader script can also compile the module for you. Make sure to install the kernel-headers on your nodes.
-
-* **Users that can wait** we will approve this document and act on the plan described here by providing the DRIVERS_REPO at  [https://download.falco.org/driver](https://download.falco.org/driver) that then you can use
-
-### How to use an alternative DRIVERS_REPO ?
-
-**On bash:**
-
-export DRIVERS_REPO=https://your-url-here
-
-**Docker**
-
-Pass it as environment variable using the docker run flag -e - for example:
-
-docker run -e DRIVERS_REPO=[https://your-url-here](https://your-url-here)
-
-**Kubernetes**
-
-spec:
-
-  containers:
-
-  - env:
-
-    - name: DRIVERS_REPO
-
-      value: https://your-url-here
-
-## Release
-
-Next release is on December 1st, we want to rollout a hotfix 0.26.2 release that only contains the updated script before that date so that users don’t get confused and we can just tell them "update Falco" to get the thing working again.
-
--- a/proposals/20201025-drivers-storage-s3_downloads.png
+++ b/proposals/20201025-drivers-storage-s3_downloads.png
--- a/rules/falco_rules.yaml
+++ b/rules/falco_rules.yaml
@@ -522,7 +522,7 @@
 - macro: container_started
  condition: >
    ((evt.type = container or
-     (spawned_process and proc.vpid=1)) and
+     (evt.type=execve and evt.dir=< and proc.vpid=1)) and
     container.image.repository != incomplete)

 - macro: interactive
@@ -1213,9 +1213,6 @@
       fd.name startswith /etc/ssh/ssh_monitor_config_ or
       fd.name startswith /etc/ssh/ssh_config_))

- macro: multipath_writing_conf
-  condition: (proc.name = multipath and fd.name startswith /etc/multipath/)
-
 # Add conditions to this macro (probably in a separate file,
 # overwriting this macro) to allow for specific combinations of
 # programs writing below specific directories below
@@ -1336,7 +1333,6 @@
    and not automount_using_mtab
    and not mcafee_writing_cma_d
    and not avinetworks_supervisor_writing_ssh
-    and not multipath_writing_conf

 - rule: Write below etc
  desc: an attempt to write to any file below /etc
@@ -1612,7 +1608,7 @@
 # to change thread namespace without having to copy and override the
 # entire change thread namespace rule.
 - list: user_known_change_thread_namespace_binaries
-  items: [crio, multus]
+  items: []

 - macro: user_known_change_thread_namespace_activities
  condition: (never_true)
@@ -1870,7 +1866,6 @@
 - list: falco_privileged_images
  items: [
    docker.io/calico/node,
-    calico/node,
    docker.io/cloudnativelabs/kube-router,
    docker.io/docker/ucp-agent,
    docker.io/falcosecurity/falco,
@@ -1923,7 +1918,6 @@
 - list: falco_sensitive_mount_images
  items: [
    docker.io/sysdig/falco, docker.io/sysdig/sysdig, sysdig/falco, sysdig/sysdig,
-    docker.io/falcosecurity/falco, falcosecurity/falco,
    gcr.io/google_containers/hyperkube,
    gcr.io/google_containers/kube-proxy, docker.io/calico/node,
    docker.io/rook/toolbox, docker.io/cloudnativelabs/kube-router, docker.io/consul,
@@ -2319,9 +2313,6 @@
 - macro: user_known_user_management_activities
  condition: (never_true)

- macro: chage_list
-  condition: (proc.name=chage and (proc.cmdline contains "-l" or proc.cmdline contains "--list"))
-
 - rule: User mgmt binaries
  desc: >
    activity by any programs that can manage users, passwords, or permissions. sudo and su are excluded.
@@ -2340,7 +2331,6 @@
    not run_by_yum and
    not run_by_ms_oms and
    not run_by_google_accounts_daemon and
-    not chage_list and
    not user_known_user_management_activities
  output: >
    User management binary command run outside of container
@@ -2738,18 +2728,10 @@
 - macro: remote_file_copy_procs
  condition: (proc.name in (remote_file_copy_binaries))

-# Users should overwrite this macro to specify conditions under which a
-# Custom condition for use of remote file copy tool in container
- macro: user_known_remote_file_copy_activities
-  condition: (never_true)
-
 - rule: Launch Remote File Copy Tools in Container
  desc: Detect remote file copy tools launched in container
  condition: >
-    spawned_process
-    and container
-    and remote_file_copy_procs
-    and not user_known_remote_file_copy_activities
+    spawned_process and container and remote_file_copy_procs
  output: >
    Remote file copy tool launched in container (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline parent_process=%proc.pname
    container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag)
@@ -2872,22 +2854,12 @@
 - list: k8s_client_binaries
  items: [docker, kubectl, crictl]

- list: user_known_k8s_ns_kube_system_images
-  items: [
-      k8s.gcr.io/fluentd-gcp-scaler,
-      k8s.gcr.io/node-problem-detector/node-problem-detector
-  ]
-
- list: user_known_k8s_images
-  items: [
-      mcr.microsoft.com/aks/hcp/hcp-tunnel-front
-  ]
-
 # Whitelist for known docker client binaries run inside container
 # - k8s.gcr.io/fluentd-gcp-scaler in GCP/GKE
 - macro: user_known_k8s_client_container
  condition: >
-    (k8s.ns.name="kube-system" and container.image.repository in (user_known_k8s_ns_kube_system_images)) or container.image.repository in (user_known_k8s_images)
+    (k8s.ns.name="kube-system" and container.image.repository=k8s.gcr.io/fluentd-gcp-scaler) or
+    container.image.repository=mcr.microsoft.com/aks/hcp/hcp-tunnel-front

 - macro: user_known_k8s_client_container_parens
  condition: (user_known_k8s_client_container)
@@ -3050,41 +3022,6 @@
  output: Drift detected (open+create), new executable created in a container (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline filename=%evt.arg.filename name=%evt.arg.name mode=%evt.arg.mode event=%evt.type)
  priority: ERROR

- list: c2_server_ip_list
-  items: []
-
- rule: Outbound Connection to C2 Servers
-  desc: Detect outbound connection to command & control servers
-  condition: outbound and fd.sip in (c2_server_ip_list)
-  output: Outbound connection to C2 server (command=%proc.cmdline connection=%fd.name user=%user.name user_loginuid=%user.loginuid container_id=%container.id image=%container.image.repository)
-  priority: WARNING
-  tags: [network]
-
- list: white_listed_modules
-  items: []
-    
- rule: Linux Kernel Module Injection Detected
-  desc: Detect kernel module was injected (from container).
-  condition: spawned_process and container and proc.name=insmod and not proc.args in (white_listed_modules)
-  output: Linux Kernel Module injection using insmod detected (user=%user.name user_loginuid=%user.loginuid parent_process=%proc.pname module=%proc.args)
-  priority: WARNING
-  tags: [process]
-
- list: run_as_root_image_list
-  items: []
-
- macro: user_known_run_as_root_container
-  condition: (container.image.repository in (run_as_root_image_list))
-
-# The rule is disabled by default and should be enabled when non-root container policy has been applied.
-# Note the rule will not work as expected when usernamespace is applied, e.g. userns-remap is enabled.
- rule: Container Run as Root User
-  desc: Detected container running as root user
-  condition: spawned_process and container and proc.vpid=1 and user.uid=0 and not user_known_run_as_root_container
-  enabled: false
-  output: Container launched with root user privilege (uid=%user.uid container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag)
-  priority: INFO
-  tags: [container, process]

 # Application rules have moved to application_rules.yaml. Please look
 # there if you want to enable them by adding to
--- a/rules/k8s_audit_rules.yaml
+++ b/rules/k8s_audit_rules.yaml
@@ -49,8 +49,7 @@
    "kubernetes-admin",
    vertical_pod_autoscaler_users,
    cluster-autoscaler,
-    "system:addon-manager",
-    "cloud-controller-manager"
+    "system:addon-manager"
    ]

 - rule: Disallowed K8s User
@@ -537,7 +536,7 @@
  condition: >
    kevt 
    and non_system_user 
-    and ka.user.name in (full_admin_k8s_users)
+    and ka.user.name in (admin_k8s_users) 
    and not allowed_full_admin_users
  output: K8s Operation performed by full admin user (user=%ka.user.name target=%ka.target.name/%ka.target.resource verb=%ka.verb uri=%ka.uri resp=%ka.response.code)
  priority: WARNING
--- a/scripts/falco-driver-loader
+++ b/scripts/falco-driver-loader
@@ -220,7 +220,7 @@ load_kernel_module() {
 	rmmod "${DRIVER_NAME}" 2>/dev/null
 	WAIT_TIME=0
 	KMOD_NAME=$(echo "${DRIVER_NAME}" | tr "-" "_")
-	while lsmod | cut -d' ' -f1 | grep -qx "${KMOD_NAME}" && [ $WAIT_TIME -lt "${MAX_RMMOD_WAIT}" ]; do 
+	while lsmod | grep "${KMOD_NAME}" > /dev/null 2>&1 && [ $WAIT_TIME -lt "${MAX_RMMOD_WAIT}" ]; do
 		if rmmod "${DRIVER_NAME}" 2>/dev/null; then
 			echo "* Unloading ${DRIVER_NAME} module succeeded after ${WAIT_TIME}s"
 			break
@@ -232,7 +232,7 @@ load_kernel_module() {
 		sleep 1
 	done

-	if lsmod | cut -d' ' -f1 | grep -qx "${KMOD_NAME}" > /dev/null 2>&1; then
+	if lsmod | grep "${KMOD_NAME}" > /dev/null 2>&1; then
 		echo "* ${DRIVER_NAME} module seems to still be loaded, hoping the best"
 		exit 0
 	fi
--- a/test/confs/program_output.yaml
+++ b/test/confs/program_output.yaml
@@ -41,4 +41,4 @@ stdout_output:

 program_output:
  enabled: true
-  program: cat >> /tmp/falco_outputs/program_output.txt
+  program: cat > /tmp/falco_outputs/program_output.txt
--- a/test/confs/stdout_output.yaml
+++ b/test/confs/stdout_output.yaml
@@ -1,42 +0,0 @@
-#
-# Copyright (C) 2020 The Falco Authors.
-#
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# File containing Falco rules, loaded at startup.
-rules_file: /etc/falco_rules.yaml
-
-# Whether to output events in json or text
-json_output: false
-
-# Send information logs to stderr and/or syslog Note these are *not* security
-# notification logs! These are just Falco lifecycle (and possibly error) logs.
-log_stderr: false
-log_syslog: false
-
-# Where security notifications should go.
-# Multiple outputs can be enabled.
-
-syslog_output:
-  enabled: false
-
-file_output:
-  enabled: false
-
-stdout_output:
-  enabled: true
-
-program_output:
-  enabled: false
--- a/test/falco_test.py
+++ b/test/falco_test.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+ #!/usr/bin/env python
 #
 # Copyright (C) 2019 The Falco Authors.
 #
@@ -31,7 +31,6 @@ from avocado.utils import process
 from watchdog.observers import Observer
 from watchdog.events import PatternMatchingEventHandler

-
 class FalcoTest(Test):

    def setUp(self):
@@ -50,20 +49,17 @@ class FalcoTest(Test):
        self.stdout_is = self.params.get('stdout_is', '*', default='')
        self.stderr_is = self.params.get('stderr_is', '*', default='')

-        self.stdout_contains = self.params.get(
-            'stdout_contains', '*', default='')
+        self.stdout_contains = self.params.get('stdout_contains', '*', default='')

        if not isinstance(self.stdout_contains, list):
            self.stdout_contains = [self.stdout_contains]

-        self.stderr_contains = self.params.get(
-            'stderr_contains', '*', default='')
+        self.stderr_contains = self.params.get('stderr_contains', '*', default='')

        if not isinstance(self.stderr_contains, list):
            self.stderr_contains = [self.stderr_contains]

-        self.stdout_not_contains = self.params.get(
-            'stdout_not_contains', '*', default='')
+        self.stdout_not_contains = self.params.get('stdout_not_contains', '*', default='')

        if not isinstance(self.stdout_not_contains, list):
            if self.stdout_not_contains == '':
@@ -71,8 +67,7 @@ class FalcoTest(Test):
            else:
                self.stdout_not_contains = [self.stdout_not_contains]

-        self.stderr_not_contains = self.params.get(
-            'stderr_not_contains', '*', default='')
+        self.stderr_not_contains = self.params.get('stderr_not_contains', '*', default='')

        if not isinstance(self.stderr_not_contains, list):
            if self.stderr_not_contains == '':
@@ -88,18 +83,15 @@ class FalcoTest(Test):
            self.trace_file = os.path.join(build_dir, "test", self.trace_file)

        self.json_output = self.params.get('json_output', '*', default=False)
-        self.json_include_output_property = self.params.get(
-            'json_include_output_property', '*', default=True)
+        self.json_include_output_property = self.params.get('json_include_output_property', '*', default=True)
        self.all_events = self.params.get('all_events', '*', default=False)
        self.priority = self.params.get('priority', '*', default='debug')
-        self.rules_file = self.params.get(
-            'rules_file', '*', default=os.path.join(self.basedir, '../rules/falco_rules.yaml'))
+        self.rules_file = self.params.get('rules_file', '*', default=os.path.join(self.basedir, '../rules/falco_rules.yaml'))

        if not isinstance(self.rules_file, list):
            self.rules_file = [self.rules_file]

-        self.validate_rules_file = self.params.get(
-            'validate_rules_file', '*', default=False)
+        self.validate_rules_file = self.params.get('validate_rules_file', '*', default=False)

        if self.validate_rules_file == False:
            self.validate_rules_file = []
@@ -126,15 +118,13 @@ class FalcoTest(Test):
                file = os.path.join(self.basedir, file)
            self.rules_args = self.rules_args + "-r " + file + " "

-        self.conf_file = self.params.get(
-            'conf_file', '*', default=os.path.join(self.basedir, '../falco.yaml'))
+        self.conf_file = self.params.get('conf_file', '*', default=os.path.join(self.basedir, '../falco.yaml'))
        if not os.path.isabs(self.conf_file):
            self.conf_file = os.path.join(self.basedir, self.conf_file)

        self.run_duration = self.params.get('run_duration', '*', default='')

-        self.disabled_rules = self.params.get(
-            'disabled_rules', '*', default='')
+        self.disabled_rules = self.params.get('disabled_rules', '*', default='')

        if self.disabled_rules == '':
            self.disabled_rules = []
@@ -147,8 +137,7 @@ class FalcoTest(Test):
        for rule in self.disabled_rules:
            self.disabled_args = self.disabled_args + "-D " + rule + " "

-        self.detect_counts = self.params.get(
-            'detect_counts', '*', default=False)
+        self.detect_counts = self.params.get('detect_counts', '*', default=False)
        if self.detect_counts == False:
            self.detect_counts = {}
        else:
@@ -158,8 +147,7 @@ class FalcoTest(Test):
                    detect_counts[key] = value
            self.detect_counts = detect_counts

-        self.rules_warning = self.params.get(
-            'rules_warning', '*', default=False)
+        self.rules_warning = self.params.get('rules_warning', '*', default=False)
        if self.rules_warning == False:
            self.rules_warning = set()
        else:
@@ -184,11 +172,9 @@ class FalcoTest(Test):

        self.package = self.params.get('package', '*', default='None')

-        self.addl_docker_run_args = self.params.get(
-            'addl_docker_run_args', '*', default='')
+        self.addl_docker_run_args = self.params.get('addl_docker_run_args', '*', default='')

-        self.copy_local_driver = self.params.get(
-            'copy_local_driver', '*', default=False)
+        self.copy_local_driver = self.params.get('copy_local_driver', '*', default=False)

        # Used by possibly_copy_local_driver as well as docker run
        self.module_dir = os.path.expanduser("~/.falco")
@@ -211,33 +197,9 @@ class FalcoTest(Test):
                        os.makedirs(filedir)
            self.outputs = outputs

-        self.output_strictly_contains = self.params.get(
-            'output_strictly_contains', '*', default='')
-
-        if self.output_strictly_contains == '':
-            self.output_strictly_contains = {}
-        else:
-            output_strictly_contains = []
-            for item in self.output_strictly_contains:
-                for key, value in list(item.items()):
-                    output = {}
-                    output['actual'] = key
-                    output['expected'] = value
-                    output_strictly_contains.append(output)
-                    if not output['actual'] == 'stdout':
-                        # Clean up file from previous tests, if any
-                        if os.path.exists(output['actual']):
-                            os.remove(output['actual'])
-                        # Create the parent directory for the file if it doesn't exist.
-                        filedir = os.path.dirname(output['actual'])
-                        if not os.path.isdir(filedir):
-                            os.makedirs(filedir)
-            self.output_strictly_contains = output_strictly_contains
-
        self.grpcurl_res = None
        self.grpc_observer = None
-        self.grpc_address = self.params.get(
-            'address', 'grpc/*', default='/var/run/falco.sock')
+        self.grpc_address = self.params.get('address', 'grpc/*', default='/var/run/falco.sock')
        if self.grpc_address.startswith("unix://"):
            self.is_grpc_using_unix_socket = True
            self.grpc_address = self.grpc_address[len("unix://"):]
@@ -249,22 +211,21 @@ class FalcoTest(Test):
        self.grpc_results = self.params.get('results', 'grpc/*', default='')
        if self.grpc_results == '':
            self.grpc_results = []
-        else:
+        else: 
            if type(self.grpc_results) == str:
                self.grpc_results = [self.grpc_results]

        self.disable_tags = self.params.get('disable_tags', '*', default='')

        if self.disable_tags == '':
-            self.disable_tags = []
+            self.disable_tags=[]

        self.run_tags = self.params.get('run_tags', '*', default='')

        if self.run_tags == '':
-            self.run_tags = []
+            self.run_tags=[]

-        self.time_iso_8601 = self.params.get(
-            'time_iso_8601', '*', default=False)
+        self.time_iso_8601 = self.params.get('time_iso_8601', '*', default=False)

    def tearDown(self):
        if self.package != 'None':
@@ -283,8 +244,7 @@ class FalcoTest(Test):
        self.log.debug("Actual warning rules: {}".format(found_warning))

        if found_warning != self.rules_warning:
-            self.fail("Expected rules with warnings {} does not match actual rules with warnings {}".format(
-                self.rules_warning, found_warning))
+            self.fail("Expected rules with warnings {} does not match actual rules with warnings {}".format(self.rules_warning, found_warning))

    def check_rules_events(self, res):

@@ -295,60 +255,50 @@ class FalcoTest(Test):
            events = set(match.group(2).split(","))
            found_events[rule] = events

-        self.log.debug(
-            "Expected events for rules: {}".format(self.rules_events))
+        self.log.debug("Expected events for rules: {}".format(self.rules_events))
        self.log.debug("Actual events for rules: {}".format(found_events))

        for rule in list(found_events.keys()):
            if found_events.get(rule) != self.rules_events.get(rule):
-                self.fail("rule {}: expected events {} differs from actual events {}".format(
-                    rule, self.rules_events.get(rule), found_events.get(rule)))
+                self.fail("rule {}: expected events {} differs from actual events {}".format(rule, self.rules_events.get(rule), found_events.get(rule)))

    def check_detections(self, res):
        # Get the number of events detected.
        match = re.search('Events detected: (\d+)', res.stdout.decode("utf-8"))
        if match is None:
-            self.fail(
-                "Could not find a line 'Events detected: <count>' in falco output")
+            self.fail("Could not find a line 'Events detected: <count>' in falco output")

        events_detected = int(match.group(1))

        if not self.should_detect and events_detected > 0:
-            self.fail("Detected {} events when should have detected none".format(
-                events_detected))
+            self.fail("Detected {} events when should have detected none".format(events_detected))

        if self.should_detect:
            if events_detected == 0:
-                self.fail("Detected {} events when should have detected > 0".format(
-                    events_detected))
+                self.fail("Detected {} events when should have detected > 0".format(events_detected))

            for level in self.detect_level:
                level_line = '(?i){}: (\d+)'.format(level)
                match = re.search(level_line, res.stdout.decode("utf-8"))

                if match is None:
-                    self.fail(
-                        "Could not find a line '{}: <count>' in falco output".format(level))
+                    self.fail("Could not find a line '{}: <count>' in falco output".format(level))

                    events_detected = int(match.group(1))

                    if not events_detected > 0:
-                        self.fail("Detected {} events at level {} when should have detected > 0".format(
-                            events_detected, level))
+                        self.fail("Detected {} events at level {} when should have detected > 0".format(events_detected, level))

    def check_detections_by_rule(self, res):
        # Get the number of events detected for each rule. Must match the expected counts.
-        match = re.search('Triggered rules by rule name:(.*)',
-                          res.stdout.decode("utf-8"), re.DOTALL)
+        match = re.search('Triggered rules by rule name:(.*)', res.stdout.decode("utf-8"), re.DOTALL)
        if match is None:
-            self.fail(
-                "Could not find a block 'Triggered rules by rule name: ...' in falco output")
+            self.fail("Could not find a block 'Triggered rules by rule name: ...' in falco output")

        triggered_rules = match.group(1)

        for rule, count in list(self.detect_counts.items()):
-            expected = '\s{}: (\d+)'.format(
-                re.sub(r'([$\.*+?()[\]{}|^])', r'\\\1', rule))
+            expected = '\s{}: (\d+)'.format(re.sub(r'([$\.*+?()[\]{}|^])', r'\\\1', rule))
            match = re.search(expected, triggered_rules)

            if match is None:
@@ -357,11 +307,9 @@ class FalcoTest(Test):
                actual_count = int(match.group(1))

            if actual_count != count:
-                self.fail("Different counts for rule {}: expected={}, actual={}".format(
-                    rule, count, actual_count))
+                self.fail("Different counts for rule {}: expected={}, actual={}".format(rule, count, actual_count))
            else:
-                self.log.debug(
-                    "Found expected count for rule {}: {}".format(rule, count))
+                self.log.debug("Found expected count for rule {}: {}".format(rule, count))

    def check_outputs(self):
        for output in self.outputs:
@@ -376,8 +324,7 @@ class FalcoTest(Test):
                    found = True

            if found == False:
-                self.fail("Could not find a line '{}' in file '{}'".format(
-                    output['line'], output['file']))
+                self.fail("Could not find a line '{}' in file '{}'".format(output['line'], output['file']))

        return True

@@ -394,27 +341,7 @@ class FalcoTest(Test):
                        attrs = ['time', 'rule', 'priority']
                    for attr in attrs:
                        if not attr in obj:
-                            self.fail(
-                                "Falco JSON object {} does not contain property \"{}\"".format(line, attr))
-
-    def check_output_strictly_contains(self, res):
-        for output in self.output_strictly_contains:
-            # Read the expected output (from a file) and actual output (either from a file or the stdout),
-            # then check if the actual one strictly contains the expected one.
-
-            expected = open(output['expected']).read()
-
-            if output['actual'] == 'stdout':
-                actual = res.stdout.decode("utf-8")
-            else:
-                actual = open(output['actual']).read()
-
-            if expected not in actual:
-                self.fail("Output '{}' does not strictly contains the expected content '{}'".format(
-                    output['actual'], output['expected']))
-                return False
-
-        return True
+                            self.fail("Falco JSON object {} does not contain property \"{}\"".format(line, attr))

    def install_package(self):

@@ -433,39 +360,35 @@ class FalcoTest(Test):
                                         self.module_dir, self.addl_docker_run_args, image)

        elif self.package.endswith(".deb"):
-            self.falco_binary_path = '/usr/bin/falco'
+            self.falco_binary_path = '/usr/bin/falco';

            package_glob = "{}/{}".format(self.falcodir, self.package)

            matches = glob.glob(package_glob)

            if len(matches) != 1:
-                self.fail("Package path {} did not match exactly 1 file. Instead it matched: {}",
-                          package_glob, ",".join(matches))
+                self.fail("Package path {} did not match exactly 1 file. Instead it matched: {}", package_glob, ",".join(matches))

            package_path = matches[0]

            cmdline = "dpkg -i {}".format(package_path)
-            self.log.debug(
-                "Installing debian package via \"{}\"".format(cmdline))
+            self.log.debug("Installing debian package via \"{}\"".format(cmdline))
            res = process.run(cmdline, timeout=120, sudo=True)

        elif self.package.endswith(".rpm"):
-            self.falco_binary_path = '/usr/bin/falco'
+            self.falco_binary_path = '/usr/bin/falco';

            package_glob = "{}/{}".format(self.falcodir, self.package)

            matches = glob.glob(package_glob)

            if len(matches) != 1:
-                self.fail("Package path {} did not match exactly 1 file. Instead it matched: {}",
-                          package_glob, ",".join(matches))
+                self.fail("Package path {} did not match exactly 1 file. Instead it matched: {}", package_glob, ",".join(matches))

            package_path = matches[0]

            cmdline = "rpm -i --nodeps --noscripts {}".format(package_path)
-            self.log.debug(
-                "Installing centos package via \"{}\"".format(cmdline))
+            self.log.debug("Installing centos package via \"{}\"".format(cmdline))
            res = process.run(cmdline, timeout=120, sudo=True)

    def uninstall_package(self):
@@ -475,29 +398,25 @@ class FalcoTest(Test):

        elif self.package.endswith(".rpm"):
            cmdline = "rpm -e --noscripts --nodeps falco"
-            self.log.debug(
-                "Uninstalling centos package via \"{}\"".format(cmdline))
+            self.log.debug("Uninstalling centos package via \"{}\"".format(cmdline))
            res = process.run(cmdline, timeout=120, sudo=True)

        elif self.package.endswith(".deb"):
            cmdline = "dpkg --purge falco"
-            self.log.debug(
-                "Uninstalling debian package via \"{}\"".format(cmdline))
+            self.log.debug("Uninstalling debian package via \"{}\"".format(cmdline))
            res = process.run(cmdline, timeout=120, sudo=True)

    def possibly_copy_driver(self):
        # Remove the contents of ~/.falco regardless of copy_local_driver.
        self.log.debug("Checking for module dir {}".format(self.module_dir))
        if os.path.isdir(self.module_dir):
-            self.log.info(
-                "Removing files below directory {}".format(self.module_dir))
+            self.log.info("Removing files below directory {}".format(self.module_dir))
            for rmfile in glob.glob(self.module_dir + "/*"):
                self.log.debug("Removing file {}".format(rmfile))
                os.remove(rmfile)

        if self.copy_local_driver:
-            verlines = [str.strip() for str in subprocess.check_output(
-                [self.falco_binary_path, "--version"]).splitlines()]
+            verlines = [str.strip() for str in subprocess.check_output([self.falco_binary_path, "--version"]).splitlines()]
            verstr = verlines[0].decode("utf-8")
            self.log.info("verstr {}".format(verstr))
            falco_version = verstr.split(" ")[2]
@@ -509,12 +428,10 @@ class FalcoTest(Test):

            # falco-driver-loader has a more comprehensive set of ways to
            # find the config hash. We only look at /boot/config-<kernel release>
-            md5_output = subprocess.check_output(
-                ["md5sum", "/boot/config-{}".format(kernel_release)]).rstrip()
+            md5_output = subprocess.check_output(["md5sum", "/boot/config-{}".format(kernel_release)]).rstrip()
            config_hash = md5_output.split(" ")[0]

-            probe_filename = "falco-{}-{}-{}-{}.ko".format(
-                falco_version, arch, kernel_release, config_hash)
+            probe_filename = "falco-{}-{}-{}-{}.ko".format(falco_version, arch, kernel_release, config_hash)
            driver_path = os.path.join(self.falcodir, "driver", "falco.ko")
            module_path = os.path.join(self.module_dir, probe_filename)
            self.log.debug("Copying {} to {}".format(driver_path, module_path))
@@ -525,22 +442,20 @@ class FalcoTest(Test):
        if len(self.grpc_results) > 0:
            if not self.is_grpc_using_unix_socket:
                self.fail("This test suite supports gRPC with unix socket only")
-
-            cmdline = "grpcurl -format text -import-path ../userspace/falco " \
-                "-proto {} -plaintext -unix {} " \
-                "{}/{}".format(self.grpc_proto, self.grpc_address,
-                               self.grpc_service, self.grpc_method)
+            
+            cmdline = "grpcurl -import-path ../userspace/falco " \
+                            "-proto {} -plaintext -unix {} " \
+                            "{}/{}".format(self.grpc_proto, self.grpc_address, self.grpc_service, self.grpc_method)
            that = self
-
            class GRPCUnixSocketEventHandler(PatternMatchingEventHandler):
                def on_created(self, event):
                    # that.log.info("EVENT: {}", event)
                    that.grpcurl_res = process.run(cmdline)
-
+                    
            path = os.path.dirname(self.grpc_address)
            process.run("mkdir -p {}".format(path))
            event_handler = GRPCUnixSocketEventHandler(patterns=['*'],
-                                                       ignore_directories=True)
+                                ignore_directories=True)
            self.grpc_observer = Observer()
            self.grpc_observer.schedule(event_handler, path, recursive=False)
            self.grpc_observer.start()
@@ -555,19 +470,19 @@ class FalcoTest(Test):
            for exp_result in self.grpc_results:
                found = False
                for line in self.grpcurl_res.stdout.decode("utf-8").splitlines():
-                    if exp_result in line:
+                    match = re.search(exp_result, line)
+
+                    if match is not None:
                        found = True
-                        break

                if found == False:
-                    self.fail(
-                        "Could not find a line with '{}' in gRPC responses (protobuf text".format(exp_result))
+                    self.fail("Could not find a line '{}' in gRPC responses".format(exp_result))
+

    def test(self):
        self.log.info("Trace file %s", self.trace_file)

-        self.falco_binary_path = '{}/userspace/falco/falco'.format(
-            self.falcodir)
+        self.falco_binary_path = '{}/userspace/falco/falco'.format(self.falcodir)

        self.possibly_copy_driver()

@@ -586,11 +501,9 @@ class FalcoTest(Test):
        if self.psp_file != "":

            if not os.path.isfile(self.psp_conv_path):
-                self.log.info("Downloading {} to {}".format(
-                    self.psp_conv_url, self.psp_conv_path))
+                self.log.info("Downloading {} to {}".format(self.psp_conv_url, self.psp_conv_path))

-                urllib.request.urlretrieve(
-                    self.psp_conv_url, self.psp_conv_path)
+                urllib.request.urlretrieve(self.psp_conv_url, self.psp_conv_path)
                os.chmod(self.psp_conv_path, stat.S_IEXEC)

            conv_cmd = '{} convert psp --psp-path {} --rules-path {}'.format(
@@ -608,6 +521,7 @@ class FalcoTest(Test):
                psp_rules = myfile.read()
                self.log.debug("Converted Rules: {}".format(psp_rules))

+
        # Run falco
        cmd = '{} {} {} -c {} {} -o json_output={} -o json_include_output_property={} -o priority={} -v'.format(
            self.falco_binary_path, self.rules_args, self.disabled_args, self.conf_file, trace_arg, self.json_output, self.json_include_output_property, self.priority)
@@ -643,26 +557,22 @@ class FalcoTest(Test):
        for pattern in self.stderr_contains:
            match = re.search(pattern, res.stderr.decode("utf-8"))
            if match is None:
-                self.fail(
-                    "Stderr of falco process did not contain content matching {}".format(pattern))
+                self.fail("Stderr of falco process did not contain content matching {}".format(pattern))

        for pattern in self.stdout_contains:
            match = re.search(pattern, res.stdout.decode("utf-8"))
            if match is None:
-                self.fail("Stdout of falco process '{}' did not contain content matching {}".format(
-                    res.stdout.decode("utf-8"), pattern))
+                self.fail("Stdout of falco process '{}' did not contain content matching {}".format(res.stdout.decode("utf-8"), pattern))

        for pattern in self.stderr_not_contains:
            match = re.search(pattern, res.stderr.decode("utf-8"))
            if match is not None:
-                self.fail(
-                    "Stderr of falco process contained content matching {} when it should have not".format(pattern))
+                self.fail("Stderr of falco process contained content matching {} when it should have not".format(pattern))

        for pattern in self.stdout_not_contains:
            match = re.search(pattern, res.stdout.decode("utf-8"))
            if match is not None:
-                self.fail("Stdout of falco process '{}' did contain content matching {} when it should have not".format(
-                    res.stdout.decode("utf-8"), pattern))
+                self.fail("Stdout of falco process '{}' did contain content matching {} when it should have not".format(res.stdout.decode("utf-8"), pattern))

        if res.exit_status != self.exit_status:
            self.error("Falco command \"{}\" exited with unexpected return value {} (!= {})".format(
@@ -680,7 +590,6 @@ class FalcoTest(Test):
            self.check_detections_by_rule(res)
        self.check_json_output(res)
        self.check_outputs()
-        self.check_output_strictly_contains(res)
        self.check_grpc()
        pass

--- a/test/falco_tests.yaml
+++ b/test/falco_tests.yaml
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2020 The Falco Authors.
+# Copyright (C) 2016-2018 The Falco Authors..
 #
 # This file is part of falco.
 #
@@ -652,50 +652,25 @@ trace_files: !mux
    trace_file: trace_files/cat_write.scap
    stdout_contains: "Warning An open was seen .cport=<NA> command=cat /dev/null."

-  stdout_output_strict:
-    detect: True
-    detect_level: WARNING
-    rules_file:
-      - rules/single_rule.yaml
-    conf_file: confs/stdout_output.yaml
-    trace_file: trace_files/cat_write.scap
-    time_iso_8601: true
-    output_strictly_contains:
-      - stdout: output_files/single_rule_with_cat_write.txt
-
-  stdout_output_json_strict:
-    json_output: True
-    detect: True
-    detect_level: WARNING
-    rules_file:
-      - rules/single_rule.yaml
-    conf_file: confs/stdout_output.yaml
-    trace_file: trace_files/cat_write.scap
-    time_iso_8601: true
-    output_strictly_contains:
-      - stdout: output_files/single_rule_with_cat_write.json
-
-  file_output_strict:
+  file_output:
    detect: True
    detect_level: WARNING
    rules_file:
      - rules/single_rule.yaml
    conf_file: confs/file_output.yaml
    trace_file: trace_files/cat_write.scap
-    time_iso_8601: true
-    output_strictly_contains:
-      - /tmp/falco_outputs/file_output.txt: output_files/single_rule_with_cat_write.txt
+    outputs:
+      - /tmp/falco_outputs/file_output.txt: Warning An open was seen

-  program_output_strict:
+  program_output:
    detect: True
    detect_level: WARNING
    rules_file:
      - rules/single_rule.yaml
    conf_file: confs/program_output.yaml
    trace_file: trace_files/cat_write.scap
-    time_iso_8601: true
-    output_strictly_contains:
-      - /tmp/falco_outputs/program_output.txt: output_files/single_rule_with_cat_write.txt
+    outputs:
+      - /tmp/falco_outputs/program_output.txt: Warning An open was seen

  grpc_unix_socket_outputs:
    detect: True
@@ -705,26 +680,13 @@ trace_files: !mux
    conf_file: confs/grpc_unix_socket.yaml
    trace_file: trace_files/cat_write.scap
    run_duration: 5
-    time_iso_8601: true
    grpc:
      address: unix:///tmp/falco/falco.sock
      proto: outputs.proto
      service: falco.outputs.service
      method: get
-      # protobuf text format
      results:
-        - "seconds:1470327477 nanos:881781397"
-        - "priority: WARNING"
-        - "rule: \"open_from_cat\""
-        - "output: \"2016-08-04T16:17:57.881781397+0000: Warning An open was seen (command=cat /dev/null)\""
-        # output fields
-        - "key: \"evt.time.iso8601\""
-        - "value: \"2016-08-04T16:17:57.881781397+0000\""
-        - "key: \"proc.cmdline\""
-        - "value: \"cat /dev/null\""
-        # For the hostname, since we don't know that beforehand,
-        # only check the field presence
-        - "hostname: "
+        - "Warning An open was seen"

  detect_counts:
    detect: True
--- a/test/output_files/single_rule_with_cat_write.json
+++ b/test/output_files/single_rule_with_cat_write.json
@@ -1,8 +0,0 @@
-{"output":"2016-08-04T16:17:57.881781397+0000: Warning An open was seen (command=cat /dev/null)","priority":"Warning","rule":"open_from_cat","time":"2016-08-04T16:17:57.881781397Z", "output_fields": {"evt.time.iso8601":1470327477881781397,"proc.cmdline":"cat /dev/null"}}
-{"output":"2016-08-04T16:17:57.881785348+0000: Warning An open was seen (command=cat /dev/null)","priority":"Warning","rule":"open_from_cat","time":"2016-08-04T16:17:57.881785348Z", "output_fields": {"evt.time.iso8601":1470327477881785348,"proc.cmdline":"cat /dev/null"}}
-{"output":"2016-08-04T16:17:57.881796705+0000: Warning An open was seen (command=cat /dev/null)","priority":"Warning","rule":"open_from_cat","time":"2016-08-04T16:17:57.881796705Z", "output_fields": {"evt.time.iso8601":1470327477881796705,"proc.cmdline":"cat /dev/null"}}
-{"output":"2016-08-04T16:17:57.881799840+0000: Warning An open was seen (command=cat /dev/null)","priority":"Warning","rule":"open_from_cat","time":"2016-08-04T16:17:57.881799840Z", "output_fields": {"evt.time.iso8601":1470327477881799840,"proc.cmdline":"cat /dev/null"}}
-{"output":"2016-08-04T16:17:57.882003104+0000: Warning An open was seen (command=cat /dev/null)","priority":"Warning","rule":"open_from_cat","time":"2016-08-04T16:17:57.882003104Z", "output_fields": {"evt.time.iso8601":1470327477882003104,"proc.cmdline":"cat /dev/null"}}
-{"output":"2016-08-04T16:17:57.882008208+0000: Warning An open was seen (command=cat /dev/null)","priority":"Warning","rule":"open_from_cat","time":"2016-08-04T16:17:57.882008208Z", "output_fields": {"evt.time.iso8601":1470327477882008208,"proc.cmdline":"cat /dev/null"}}
-{"output":"2016-08-04T16:17:57.882045694+0000: Warning An open was seen (command=cat /dev/null)","priority":"Warning","rule":"open_from_cat","time":"2016-08-04T16:17:57.882045694Z", "output_fields": {"evt.time.iso8601":1470327477882045694,"proc.cmdline":"cat /dev/null"}}
-{"output":"2016-08-04T16:17:57.882054739+0000: Warning An open was seen (command=cat /dev/null)","priority":"Warning","rule":"open_from_cat","time":"2016-08-04T16:17:57.882054739Z", "output_fields": {"evt.time.iso8601":1470327477882054739,"proc.cmdline":"cat /dev/null"}}
--- a/test/output_files/single_rule_with_cat_write.txt
+++ b/test/output_files/single_rule_with_cat_write.txt
@@ -1,8 +0,0 @@
-2016-08-04T16:17:57.881781397+0000: Warning An open was seen (command=cat /dev/null)
-2016-08-04T16:17:57.881785348+0000: Warning An open was seen (command=cat /dev/null)
-2016-08-04T16:17:57.881796705+0000: Warning An open was seen (command=cat /dev/null)
-2016-08-04T16:17:57.881799840+0000: Warning An open was seen (command=cat /dev/null)
-2016-08-04T16:17:57.882003104+0000: Warning An open was seen (command=cat /dev/null)
-2016-08-04T16:17:57.882008208+0000: Warning An open was seen (command=cat /dev/null)
-2016-08-04T16:17:57.882045694+0000: Warning An open was seen (command=cat /dev/null)
-2016-08-04T16:17:57.882054739+0000: Warning An open was seen (command=cat /dev/null)
--- a/test/run_regression_tests.sh
+++ b/test/run_regression_tests.sh
@@ -104,12 +104,8 @@ function run_tests() {
        suites+=($SCRIPTDIR/falco_tests_package.yaml)
    fi
    
-    XUNIT_DIR="${OPT_BUILD_DIR}/integration-tests-xunit"
-    mkdir -p "${XUNIT_DIR}"
-
    for mult in "${suites[@]}"; do
-        XUNIT_FILE_NAME="${XUNIT_DIR}/$(basename "${mult}").xml"
-        CMD="avocado run --xunit ${XUNIT_FILE_NAME} --mux-yaml $mult --job-results-dir $SCRIPTDIR/job-results -- $SCRIPTDIR/falco_test.py"
+        CMD="avocado run --mux-yaml $mult --job-results-dir $SCRIPTDIR/job-results -- $SCRIPTDIR/falco_test.py"
        echo "Running $CMD"
        BUILD_DIR=${OPT_BUILD_DIR} $CMD
        RC=$?
--- a/userspace/engine/falco_engine.cpp
+++ b/userspace/engine/falco_engine.cpp
@@ -171,8 +171,9 @@ void falco_engine::load_rules(const string &rules_content, bool verbose, bool al
 					  m_ls);
 	}

-	// Note that falco_formats is added to the lua state used
-	// by the falco engine only. Within the engine, only
+	// Note that falco_formats is added to both the lua state used
+	// by the falco engine as well as the separate lua state used
+	// by falco outputs.  Within the engine, only
 	// formats.formatter is used, so we can unconditionally set
 	// json_output to false.
 	bool json_output = false;
--- a/userspace/engine/formats.cpp
+++ b/userspace/engine/formats.cpp
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -20,19 +20,24 @@ limitations under the License.
 #include "falco_engine.h"
 #include "banned.h" // This raises a compilation error when certain functions are used

-sinsp *falco_formats::s_inspector = NULL;
+
+sinsp* falco_formats::s_inspector = NULL;
 falco_engine *falco_formats::s_engine = NULL;
 bool falco_formats::s_json_output = false;
 bool falco_formats::s_json_include_output_property = true;
-std::unique_ptr<sinsp_evt_formatter_cache> falco_formats::s_formatters = NULL;
+sinsp_evt_formatter_cache *falco_formats::s_formatters = NULL;

-const static struct luaL_Reg ll_falco[] =
-	{
-		{"formatter", &falco_formats::lua_formatter},
-		{"free_formatter", &falco_formats::lua_free_formatter},
-		{NULL, NULL}};
+const static struct luaL_reg ll_falco [] =
+{
+	{"formatter", &falco_formats::formatter},
+	{"free_formatter", &falco_formats::free_formatter},
+	{"free_formatters", &falco_formats::free_formatters},
+	{"format_event", &falco_formats::format_event},
+	{"resolve_tokens", &falco_formats::resolve_tokens},
+	{NULL,NULL}
+};

-void falco_formats::init(sinsp *inspector,
+void falco_formats::init(sinsp* inspector,
 			 falco_engine *engine,
 			 lua_State *ls,
 			 bool json_output,
@@ -42,14 +47,15 @@ void falco_formats::init(sinsp *inspector,
 	s_engine = engine;
 	s_json_output = json_output;
 	s_json_include_output_property = json_include_output_property;
-
-	// todo(leogr): we should have used std::make_unique, but we cannot since it's not C++14
-	s_formatters = std::unique_ptr<sinsp_evt_formatter_cache>(new sinsp_evt_formatter_cache(s_inspector));
+	if(!s_formatters)
+	{
+		s_formatters = new sinsp_evt_formatter_cache(s_inspector);
+	}

 	luaL_openlib(ls, "formats", ll_falco, 0);
 }

-int falco_formats::lua_formatter(lua_State *ls)
+int falco_formats::formatter(lua_State *ls)
 {
 	string source = luaL_checkstring(ls, -2);
 	string format = luaL_checkstring(ls, -1);
@@ -58,7 +64,7 @@ int falco_formats::lua_formatter(lua_State *ls)
 	{
 		if(source == "syscall")
 		{
-			sinsp_evt_formatter *formatter;
+			sinsp_evt_formatter* formatter;
 			formatter = new sinsp_evt_formatter(s_inspector, format);
 			lua_pushlightuserdata(ls, formatter);
 		}
@@ -69,11 +75,11 @@ int falco_formats::lua_formatter(lua_State *ls)
 			lua_pushlightuserdata(ls, formatter);
 		}
 	}
-	catch(sinsp_exception &e)
+	catch(sinsp_exception& e)
 	{
 		luaL_error(ls, "Invalid output format '%s': '%s'", format.c_str(), e.what());
 	}
-	catch(falco_exception &e)
+	catch(falco_exception& e)
 	{
 		luaL_error(ls, "Invalid output format '%s': '%s'", format.c_str(), e.what());
 	}
@@ -81,10 +87,10 @@ int falco_formats::lua_formatter(lua_State *ls)
 	return 1;
 }

-int falco_formats::lua_free_formatter(lua_State *ls)
+int falco_formats::free_formatter(lua_State *ls)
 {
-	if(!lua_islightuserdata(ls, -1) ||
-	   !lua_isstring(ls, -2))
+	if (!lua_islightuserdata(ls, -1) ||
+	    !lua_isstring(ls, -2))

 	{
 		luaL_error(ls, "Invalid argument passed to free_formatter");
@@ -94,75 +100,115 @@ int falco_formats::lua_free_formatter(lua_State *ls)

 	if(source == "syscall")
 	{
-		sinsp_evt_formatter *formatter = (sinsp_evt_formatter *)lua_topointer(ls, -1);
+		sinsp_evt_formatter *formatter = (sinsp_evt_formatter *) lua_topointer(ls, -1);
 		delete(formatter);
 	}
 	else
 	{
-		json_event_formatter *formatter = (json_event_formatter *)lua_topointer(ls, -1);
+		json_event_formatter *formatter = (json_event_formatter *) lua_topointer(ls, -1);
 		delete(formatter);
 	}

 	return 0;
 }

-string falco_formats::format_event(const gen_event *evt, const std::string &rule, const std::string &source,
-				   const std::string &level, const std::string &format)
+int falco_formats::free_formatters(lua_State *ls)
 {
+	if(s_formatters)
+	{
+		delete(s_formatters);
+		s_formatters = NULL;
+	}
+	return 0;
+}

+int falco_formats::format_event (lua_State *ls)
+{
 	string line;
 	string json_line;
+
+	if (!lua_isstring(ls, -1) ||
+	    !lua_isstring(ls, -2) ||
+	    !lua_isstring(ls, -3) ||
+	    !lua_isstring(ls, -4) ||
+	    !lua_islightuserdata(ls, -5)) {
+		lua_pushstring(ls, "Invalid arguments passed to format_event()");
+		lua_error(ls);
+	}
+	gen_event* evt = (gen_event*)lua_topointer(ls, 1);
+	const char *rule = (char *) lua_tostring(ls, 2);
+	const char *source = (char *) lua_tostring(ls, 3);
+	const char *level = (char *) lua_tostring(ls, 4);
+	const char *format = (char *) lua_tostring(ls, 5);
+
 	string sformat = format;

-	if(strcmp(source.c_str(), "syscall") == 0)
+	if(strcmp(source, "syscall") == 0)
 	{
-		// This is "output"
-		s_formatters->tostring((sinsp_evt *)evt, sformat, &line);
+		try {
+			// This is "output"
+			s_formatters->tostring((sinsp_evt *) evt, sformat, &line);

-		if(s_json_output)
+			if(s_json_output)
+			{
+				sinsp_evt::param_fmt cur_fmt = s_inspector->get_buffer_format();
+				switch(cur_fmt)
+				{
+					case sinsp_evt::PF_NORMAL:
+						s_inspector->set_buffer_format(sinsp_evt::PF_JSON);
+						break;
+					case sinsp_evt::PF_EOLS:
+						s_inspector->set_buffer_format(sinsp_evt::PF_JSONEOLS);
+						break;
+					case sinsp_evt::PF_HEX:
+						s_inspector->set_buffer_format(sinsp_evt::PF_JSONHEX);
+						break;
+					case sinsp_evt::PF_HEXASCII:
+						s_inspector->set_buffer_format(sinsp_evt::PF_JSONHEXASCII);
+						break;
+					case sinsp_evt::PF_BASE64:
+						s_inspector->set_buffer_format(sinsp_evt::PF_JSONBASE64);
+						break;
+					default:
+						// do nothing
+						break;
+				}
+				// This is output fields
+				s_formatters->tostring((sinsp_evt *) evt, sformat, &json_line);
+
+				// The formatted string might have a leading newline. If it does, remove it.
+				if (json_line[0] == '\n')
+				{
+					json_line.erase(0, 1);
+				}
+				s_inspector->set_buffer_format(cur_fmt);
+			}
+		}
+		catch (sinsp_exception& e)
 		{
-			sinsp_evt::param_fmt cur_fmt = s_inspector->get_buffer_format();
-			switch(cur_fmt)
-			{
-			case sinsp_evt::PF_NORMAL:
-				s_inspector->set_buffer_format(sinsp_evt::PF_JSON);
-				break;
-			case sinsp_evt::PF_EOLS:
-				s_inspector->set_buffer_format(sinsp_evt::PF_JSONEOLS);
-				break;
-			case sinsp_evt::PF_HEX:
-				s_inspector->set_buffer_format(sinsp_evt::PF_JSONHEX);
-				break;
-			case sinsp_evt::PF_HEXASCII:
-				s_inspector->set_buffer_format(sinsp_evt::PF_JSONHEXASCII);
-				break;
-			case sinsp_evt::PF_BASE64:
-				s_inspector->set_buffer_format(sinsp_evt::PF_JSONBASE64);
-				break;
-			default:
-				// do nothing
-				break;
-			}
-			// This is output fields
-			s_formatters->tostring((sinsp_evt *)evt, sformat, &json_line);
-
-			// The formatted string might have a leading newline. If it does, remove it.
-			if(json_line[0] == '\n')
-			{
-				json_line.erase(0, 1);
-			}
-			s_inspector->set_buffer_format(cur_fmt);
+			string err = "Invalid output format '" + sformat + "': '" + string(e.what()) + "'";
+			lua_pushstring(ls, err.c_str());
+			lua_error(ls);
 		}
 	}
 	else
 	{
-		json_event_formatter formatter(s_engine->json_factory(), sformat);
+		try {

-		line = formatter.tostring((json_event *)evt);
+			json_event_formatter formatter(s_engine->json_factory(), sformat);

-		if(s_json_output)
+			line = formatter.tostring((json_event *) evt);
+
+			if(s_json_output)
+			{
+				json_line = formatter.tojson((json_event *) evt);
+			}
+		}
+		catch (exception &e)
 		{
-			json_line = formatter.tojson((json_event *)evt);
+			string err = "Invalid output format '" + sformat + "': '" + string(e.what()) + "'";
+			lua_pushstring(ls, err.c_str());
+			lua_error(ls);
 		}
 	}

@@ -171,16 +217,15 @@ string falco_formats::format_event(const gen_event *evt, const std::string &rule
 	// message as well as the event time in ns. Use this to build
 	// a more detailed object containing the event time, rule,
 	// severity, full output, and fields.
-	if(s_json_output)
-	{
+	if (s_json_output) {
 		Json::Value event;
 		Json::FastWriter writer;
 		string full_line;

 		// Convert the time-as-nanoseconds to a more json-friendly ISO8601.
-		time_t evttime = evt->get_ts() / 1000000000;
+		time_t evttime = evt->get_ts()/1000000000;
 		char time_sec[20]; // sizeof "YYYY-MM-DDTHH:MM:SS"
-		char time_ns[12];  // sizeof ".sssssssssZ"
+		char time_ns[12]; // sizeof ".sssssssssZ"
 		string iso8601evttime;

 		strftime(time_sec, sizeof(time_sec), "%FT%T", gmtime(&evttime));
@@ -201,9 +246,9 @@ string falco_formats::format_event(const gen_event *evt, const std::string &rule

 		// Json::FastWriter may add a trailing newline. If it
 		// does, remove it.
-		if(full_line[full_line.length() - 1] == '\n')
+		if (full_line[full_line.length()-1] == '\n')
 		{
-			full_line.resize(full_line.length() - 1);
+			full_line.resize(full_line.length()-1);
 		}

 		// Cheat-graft the output from the formatter into this
@@ -216,12 +261,24 @@ string falco_formats::format_event(const gen_event *evt, const std::string &rule
 		line = full_line;
 	}

-	return line.c_str();
+	lua_pushstring(ls, line.c_str());
+	return 1;
 }

-map<string, string> falco_formats::resolve_tokens(const gen_event *evt, const std::string &source, const std::string &format)
+int falco_formats::resolve_tokens(lua_State *ls)
 {
+	if(!lua_isstring(ls, -1) ||
+	   !lua_isstring(ls, -2) ||
+	   !lua_islightuserdata(ls, -3))
+	{
+		lua_pushstring(ls, "Invalid arguments passed to resolve_tokens()");
+		lua_error(ls);
+	}
+	gen_event *evt = (gen_event *)lua_topointer(ls, 1);
+	string source = luaL_checkstring(ls, 2);
+	const char *format = (char *)lua_tostring(ls, 3);
 	string sformat = format;
+
 	map<string, string> values;
 	if(source == "syscall")
 	{
@@ -231,7 +288,16 @@ map<string, string> falco_formats::resolve_tokens(const gen_event *evt, const st
 	else
 	{
 		json_event_formatter json_formatter(s_engine->json_factory(), sformat);
-		values = json_formatter.tomap((json_event *)evt);
+		values = json_formatter.tomap((json_event*) evt);
 	}
-	return values;
+
+	lua_newtable(ls);
+	for(auto const& v : values)
+	{
+		lua_pushstring(ls, v.first.c_str());
+		lua_pushstring(ls, v.second.c_str());
+		lua_settable(ls, -3);
+	}
+
+	return 1;
 }
--- a/userspace/engine/formats.h
+++ b/userspace/engine/formats.h
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -18,8 +18,7 @@ limitations under the License.

 #include "sinsp.h"

-extern "C"
-{
+extern "C" {
 #include "lua.h"
 #include "lualib.h"
 #include "lauxlib.h"
@@ -32,28 +31,31 @@ class sinsp_evt_formatter;

 class falco_formats
 {
-public:
-	static void init(sinsp *inspector,
+ public:
+	static void init(sinsp* inspector,
 			 falco_engine *engine,
 			 lua_State *ls,
 			 bool json_output,
 			 bool json_include_output_property);

 	// formatter = falco.formatter(format_string)
-	static int lua_formatter(lua_State *ls);
+	static int formatter(lua_State *ls);

 	// falco.free_formatter(formatter)
-	static int lua_free_formatter(lua_State *ls);
+	static int free_formatter(lua_State *ls);

-	static string format_event(const gen_event *evt, const std::string &rule, const std::string &source,
-				   const std::string &level, const std::string &format);
+	// falco.free_formatters()
+	static int free_formatters(lua_State *ls);

-	static map<string, string> resolve_tokens(const gen_event *evt, const std::string &source,
-						  const std::string &format);
+	// formatted_string = falco.format_event(evt, formatter)
+	static int format_event(lua_State *ls);

-	static sinsp *s_inspector;
+	// resolve_tokens = falco.resolve_tokens(evt, formatter)
+	static int resolve_tokens(lua_State *ls);
+
+	static sinsp* s_inspector;
 	static falco_engine *s_engine;
-	static std::unique_ptr<sinsp_evt_formatter_cache> s_formatters;
+	static sinsp_evt_formatter_cache *s_formatters;
 	static bool s_json_output;
 	static bool s_json_include_output_property;
 };
--- a/userspace/engine/rules.cpp
+++ b/userspace/engine/rules.cpp
@@ -26,14 +26,15 @@ extern "C" {
 #include "falco_engine.h"
 #include "banned.h" // This raises a compilation error when certain functions are used

-const static struct luaL_Reg ll_falco_rules[] =
-	{
-		{"clear_filters", &falco_rules::clear_filters},
-		{"add_filter", &falco_rules::add_filter},
-		{"add_k8s_audit_filter", &falco_rules::add_k8s_audit_filter},
-		{"enable_rule", &falco_rules::enable_rule},
-		{"engine_version", &falco_rules::engine_version},
-		{NULL, NULL}};
+const static struct luaL_reg ll_falco_rules [] =
+{
+	{"clear_filters", &falco_rules::clear_filters},
+	{"add_filter", &falco_rules::add_filter},
+	{"add_k8s_audit_filter", &falco_rules::add_k8s_audit_filter},
+	{"enable_rule", &falco_rules::enable_rule},
+	{"engine_version", &falco_rules::engine_version},
+	{NULL,NULL}
+};

 falco_rules::falco_rules(sinsp* inspector,
 			 falco_engine *engine,
--- a/userspace/falco/CMakeLists.txt
+++ b/userspace/falco/CMakeLists.txt
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2020 The Falco Authors.
+# Copyright (C) 2019 The Falco Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
 # the License. You may obtain a copy of the License at
@@ -11,88 +11,117 @@
 # specific language governing permissions and limitations under the License.
 #

-configure_file(config_falco.h.in config_falco.h)
+configure_file("${SYSDIG_SOURCE_DIR}/userspace/sysdig/config_sysdig.h.in" config_sysdig.h)

-set(
-  FALCO_SOURCES
+if(NOT MINIMAL_BUILD)
+  add_custom_command(
+    OUTPUT
+      ${CMAKE_CURRENT_BINARY_DIR}/version.grpc.pb.cc
+      ${CMAKE_CURRENT_BINARY_DIR}/version.grpc.pb.h
+      ${CMAKE_CURRENT_BINARY_DIR}/version.pb.cc
+      ${CMAKE_CURRENT_BINARY_DIR}/version.pb.h
+      ${CMAKE_CURRENT_BINARY_DIR}/outputs.grpc.pb.cc
+      ${CMAKE_CURRENT_BINARY_DIR}/outputs.grpc.pb.h
+      ${CMAKE_CURRENT_BINARY_DIR}/outputs.pb.cc
+      ${CMAKE_CURRENT_BINARY_DIR}/outputs.pb.h
+      ${CMAKE_CURRENT_BINARY_DIR}/schema.pb.cc
+      ${CMAKE_CURRENT_BINARY_DIR}/schema.pb.h
+    COMMENT "Generate gRPC API"
+    # Falco gRPC Version API
+    DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/version.proto
+    COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --cpp_out=. ${CMAKE_CURRENT_SOURCE_DIR}/version.proto
+    COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --grpc_out=. --plugin=protoc-gen-grpc=${GRPC_CPP_PLUGIN}
+            ${CMAKE_CURRENT_SOURCE_DIR}/version.proto
+    # Falco gRPC Outputs API
+    DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/outputs.proto
+    COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --cpp_out=. ${CMAKE_CURRENT_SOURCE_DIR}/outputs.proto
+            ${CMAKE_CURRENT_SOURCE_DIR}/schema.proto
+    COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --grpc_out=. --plugin=protoc-gen-grpc=${GRPC_CPP_PLUGIN}
+            ${CMAKE_CURRENT_SOURCE_DIR}/outputs.proto
+    WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
+endif()
+
+if(MINIMAL_BUILD)
+add_executable(
+  falco
  configuration.cpp
  logger.cpp
  falco_outputs.cpp
-  outputs_file.cpp
-  outputs_program.cpp
-  outputs_stdout.cpp
-  outputs_syslog.cpp
  event_drops.cpp
  statsfilewriter.cpp
  falco.cpp
-  "${SYSDIG_SOURCE_DIR}/userspace/libsinsp/fields_info.cpp"
-)
-
-set(
-  FALCO_INCLUDE_DIRECTORIES
-  "${PROJECT_SOURCE_DIR}/userspace/engine"
-  "${PROJECT_BINARY_DIR}/userspace/falco"
-  "${PROJECT_BINARY_DIR}/driver/src"
-  "${STRING_VIEW_LITE_INCLUDE}"
-  "${YAMLCPP_INCLUDE_DIR}"
-  "${CMAKE_CURRENT_BINARY_DIR}"
-  "${DRAIOS_DEPENDENCIES_DIR}/yaml-${DRAIOS_YAML_VERSION}/target/include"
-)
-
-set(
-  FALCO_DEPENDENCIES
-  string-view-lite
-  libyaml
-  b64
-  luajit
-  lpeg
-  lyaml
-)
-
-set(
-  FALCO_LIBRARIES
-  falco_engine
-  sinsp
-  "${LIBYAML_LIB}"
-  "${YAMLCPP_LIB}"
-)
-
-if(USE_BUNDLED_DEPS)
-  list(APPEND FALCO_DEPENDENCIES yamlcpp)
-endif()
-
-if(NOT MINIMAL_BUILD)
-  list(
-    APPEND FALCO_SOURCES
-    outputs_grpc.cpp
-    outputs_http.cpp
+  "${SYSDIG_SOURCE_DIR}/userspace/sysdig/fields_info.cpp")
+else()
+  add_executable(
+    falco
+    configuration.cpp
+    logger.cpp
+    falco_outputs.cpp
+    event_drops.cpp
+    statsfilewriter.cpp
+    falco.cpp
+    "${SYSDIG_SOURCE_DIR}/userspace/sysdig/fields_info.cpp"
    webserver.cpp
    grpc_context.cpp
    grpc_server_impl.cpp
    grpc_request_context.cpp
    grpc_server.cpp
-    grpc_context.cpp
-    grpc_server_impl.cpp
    ${CMAKE_CURRENT_BINARY_DIR}/version.grpc.pb.cc
    ${CMAKE_CURRENT_BINARY_DIR}/version.pb.cc
    ${CMAKE_CURRENT_BINARY_DIR}/outputs.grpc.pb.cc
    ${CMAKE_CURRENT_BINARY_DIR}/outputs.pb.cc
-    ${CMAKE_CURRENT_BINARY_DIR}/schema.pb.cc
-  )
+    ${CMAKE_CURRENT_BINARY_DIR}/schema.pb.cc)

-  list(
-    APPEND FALCO_INCLUDE_DIRECTORIES
-    "${CIVETWEB_INCLUDE_DIR}"
-    "${OPENSSL_INCLUDE_DIR}"
-    "${GRPC_INCLUDE}"
-    "${GRPCPP_INCLUDE}"
-    "${PROTOBUF_INCLUDE}"
-  )
+    add_dependencies(falco civetweb)
+endif()

-  list(APPEND FALCO_DEPENDENCIES civetweb)
+add_dependencies(falco string-view-lite)

-  list(
-    APPEND FALCO_LIBRARIES
+if(USE_BUNDLED_DEPS)
+  add_dependencies(falco yamlcpp)
+endif()
+
+if(MINIMAL_BUILD)
+  target_include_directories(
+    falco
+    PUBLIC
+      "${SYSDIG_SOURCE_DIR}/userspace/sysdig"
+      "${PROJECT_SOURCE_DIR}/userspace/engine"
+      "${PROJECT_BINARY_DIR}/userspace/falco"
+      "${PROJECT_BINARY_DIR}/driver/src"
+      "${STRING_VIEW_LITE_INCLUDE}"
+      "${YAMLCPP_INCLUDE_DIR}"
+      "${CMAKE_CURRENT_BINARY_DIR}"
+      "${DRAIOS_DEPENDENCIES_DIR}/yaml-${DRAIOS_YAML_VERSION}/target/include")
+
+  target_link_libraries(
+    falco
+    falco_engine
+    sinsp
+    "${LIBYAML_LIB}"
+    "${YAMLCPP_LIB}")
+else()
+  target_include_directories(
+    falco
+    PUBLIC
+      "${SYSDIG_SOURCE_DIR}/userspace/sysdig"
+      "${PROJECT_SOURCE_DIR}/userspace/engine"
+      "${PROJECT_BINARY_DIR}/userspace/falco"
+      "${PROJECT_BINARY_DIR}/driver/src"
+      "${STRING_VIEW_LITE_INCLUDE}"
+      "${YAMLCPP_INCLUDE_DIR}"
+      "${CIVETWEB_INCLUDE_DIR}"
+      "${OPENSSL_INCLUDE_DIR}"
+      "${GRPC_INCLUDE}"
+      "${GRPCPP_INCLUDE}"
+      "${PROTOBUF_INCLUDE}"
+      "${CMAKE_CURRENT_BINARY_DIR}"
+      "${DRAIOS_DEPENDENCIES_DIR}/yaml-${DRAIOS_YAML_VERSION}/target/include")
+
+  target_link_libraries(
+    falco
+    falco_engine
+    sinsp
    "${GPR_LIB}"
    "${GRPC_LIB}"
    "${GRPCPP_LIB}"
@@ -101,66 +130,19 @@ if(NOT MINIMAL_BUILD)
    "${OPENSSL_LIBRARY_CRYPTO}"
    "${LIBYAML_LIB}"
    "${YAMLCPP_LIB}"
-    "${CIVETWEB_LIB}"
-  )
+    "${CIVETWEB_LIB}")
 endif()

-add_executable(
-  falco
-  ${FALCO_SOURCES}
-)
-
-add_dependencies(falco ${FALCO_DEPENDENCIES})
-
-target_link_libraries(
-  falco
-  ${FALCO_LIBRARIES}
-)
-
-target_include_directories(
-  falco
-  PUBLIC
-  ${FALCO_INCLUDE_DIRECTORIES}
-)
+configure_file(config_falco.h.in config_falco.h)

 if(NOT MINIMAL_BUILD)
  add_custom_command(
    TARGET falco
    COMMAND bash ${CMAKE_CURRENT_SOURCE_DIR}/verify_engine_fields.sh ${CMAKE_SOURCE_DIR}
    WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-    COMMENT "Comparing engine fields checksum in falco_engine.h to actual fields"
-  )
+    COMMENT "Comparing engine fields checksum in falco_engine.h to actual fields")
 else()
-  message(STATUS "Skipping engine fields checksum when building the minimal Falco.")
-endif()
-
-if(NOT MINIMAL_BUILD)
-  add_custom_command(
-    OUTPUT
-    ${CMAKE_CURRENT_BINARY_DIR}/version.grpc.pb.cc
-    ${CMAKE_CURRENT_BINARY_DIR}/version.grpc.pb.h
-    ${CMAKE_CURRENT_BINARY_DIR}/version.pb.cc
-    ${CMAKE_CURRENT_BINARY_DIR}/version.pb.h
-    ${CMAKE_CURRENT_BINARY_DIR}/outputs.grpc.pb.cc
-    ${CMAKE_CURRENT_BINARY_DIR}/outputs.grpc.pb.h
-    ${CMAKE_CURRENT_BINARY_DIR}/outputs.pb.cc
-    ${CMAKE_CURRENT_BINARY_DIR}/outputs.pb.h
-    ${CMAKE_CURRENT_BINARY_DIR}/schema.pb.cc
-    ${CMAKE_CURRENT_BINARY_DIR}/schema.pb.h
-    COMMENT "Generate gRPC API"
-    # Falco gRPC Version API
-    DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/version.proto
-    COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --cpp_out=. ${CMAKE_CURRENT_SOURCE_DIR}/version.proto
-    COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --grpc_out=. --plugin=protoc-gen-grpc=${GRPC_CPP_PLUGIN}
-    ${CMAKE_CURRENT_SOURCE_DIR}/version.proto
-    # Falco gRPC Outputs API
-    DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/outputs.proto
-    COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --cpp_out=. ${CMAKE_CURRENT_SOURCE_DIR}/outputs.proto
-    ${CMAKE_CURRENT_SOURCE_DIR}/schema.proto
-    COMMAND ${PROTOC} -I ${CMAKE_CURRENT_SOURCE_DIR} --grpc_out=. --plugin=protoc-gen-grpc=${GRPC_CPP_PLUGIN}
-    ${CMAKE_CURRENT_SOURCE_DIR}/outputs.proto
-    WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
-  )
+  MESSAGE(STATUS "Skipping engine fields checksum when building the minimal Falco.")
 endif()

 # strip the Falco binary when releasing using musl
@@ -169,8 +151,12 @@ if(MUSL_OPTIMIZED_BUILD AND CMAKE_BUILD_TYPE STREQUAL "release")
    TARGET falco
    POST_BUILD
    COMMAND ${CMAKE_STRIP} --strip-unneeded falco
-    COMMENT "Strip the Falco binary when releasing the musl build"
-  )
+    COMMENT "Strip the Falco binary when releasing the musl build")
 endif()

 install(TARGETS falco DESTINATION ${FALCO_BIN_DIR})
+install(
+  DIRECTORY lua
+  DESTINATION ${FALCO_SHARE_DIR}
+  FILES_MATCHING
+  PATTERN *.lua)
--- a/userspace/falco/config_falco.h.in
+++ b/userspace/falco/config_falco.h.in
@@ -25,9 +25,11 @@ limitations under the License.
 #define FALCO_VERSION_PRERELEASE "@FALCO_VERSION_PRERELEASE@"
 #define FALCO_VERSION_BUILD "@FALCO_VERSION_BUILD@"

+#define FALCO_LUA_DIR "${CMAKE_INSTALL_PREFIX}/${FALCO_SHARE_DIR}/lua/"
 #define FALCO_SOURCE_DIR "${PROJECT_SOURCE_DIR}"
 #define FALCO_SOURCE_CONF_FILE "${PROJECT_SOURCE_DIR}/falco.yaml"
 #define FALCO_INSTALL_CONF_FILE "/etc/falco/falco.yaml"
+#define FALCO_SOURCE_LUA_DIR "${PROJECT_SOURCE_DIR}/userspace/falco/lua/"

 #define PROBE_NAME "@PROBE_NAME@"
 #define DRIVER_VERSION "@PROBE_VERSION@"
--- a/userspace/falco/configuration.cpp
+++ b/userspace/falco/configuration.cpp
@@ -47,6 +47,16 @@ falco_configuration::~falco_configuration()
 	}
 }

+// If we don't have a configuration file, we just use stdout output and all other defaults
+void falco_configuration::init(list<string> &cmdline_options)
+{
+	init_cmdline_options(cmdline_options);
+
+	falco_outputs::output_config stdout_output;
+	stdout_output.name = "stdout";
+	m_outputs.push_back(stdout_output);
+}
+
 void falco_configuration::init(string conf_filename, list<string> &cmdline_options)
 {
 	string m_config_file = conf_filename;
@@ -71,7 +81,7 @@ void falco_configuration::init(string conf_filename, list<string> &cmdline_optio
 	m_json_output = m_config->get_scalar<bool>("json_output", false);
 	m_json_include_output_property = m_config->get_scalar<bool>("json_include_output_property", true);

-	falco::outputs::config file_output;
+	falco_outputs::output_config file_output;
 	file_output.name = "file";
 	if(m_config->get_scalar<bool>("file_output", "enabled", false))
 	{
@@ -89,21 +99,21 @@ void falco_configuration::init(string conf_filename, list<string> &cmdline_optio
 		m_outputs.push_back(file_output);
 	}

-	falco::outputs::config stdout_output;
+	falco_outputs::output_config stdout_output;
 	stdout_output.name = "stdout";
 	if(m_config->get_scalar<bool>("stdout_output", "enabled", false))
 	{
 		m_outputs.push_back(stdout_output);
 	}

-	falco::outputs::config syslog_output;
+	falco_outputs::output_config syslog_output;
 	syslog_output.name = "syslog";
 	if(m_config->get_scalar<bool>("syslog_output", "enabled", false))
 	{
 		m_outputs.push_back(syslog_output);
 	}

-	falco::outputs::config program_output;
+	falco_outputs::output_config program_output;
 	program_output.name = "program";
 	if(m_config->get_scalar<bool>("program_output", "enabled", false))
 	{
@@ -121,7 +131,7 @@ void falco_configuration::init(string conf_filename, list<string> &cmdline_optio
 		m_outputs.push_back(program_output);
 	}

-	falco::outputs::config http_output;
+	falco_outputs::output_config http_output;
 	http_output.name = "http";
 	if(m_config->get_scalar<bool>("http_output", "enabled", false))
 	{
@@ -149,7 +159,7 @@ void falco_configuration::init(string conf_filename, list<string> &cmdline_optio
 	m_grpc_cert_chain = m_config->get_scalar<string>("grpc", "cert_chain", "/etc/falco/certs/server.crt");
 	m_grpc_root_certs = m_config->get_scalar<string>("grpc", "root_certs", "/etc/falco/certs/ca.crt");

-	falco::outputs::config grpc_output;
+	falco_outputs::output_config grpc_output;
 	grpc_output.name = "grpc";
 	// gRPC output is enabled only if gRPC server is enabled too
 	if(m_config->get_scalar<bool>("grpc_output", "enabled", true) && m_grpc_enabled)
@@ -166,8 +176,6 @@ void falco_configuration::init(string conf_filename, list<string> &cmdline_optio

 	falco_logger::set_level(m_log_level);

-	m_output_timeout = m_config->get_scalar<uint32_t>("output_timeout", 2000);
-
 	m_notifications_rate = m_config->get_scalar<uint32_t>("outputs", "rate", 1);
 	m_notifications_max_burst = m_config->get_scalar<uint32_t>("outputs", "max_burst", 1000);

@@ -338,4 +346,4 @@ void falco_configuration::set_cmdline_option(const string &opt)
 	{
 		m_config->set_scalar(keyval.first, keyval.second);
 	}
-}
+}
--- a/userspace/falco/configuration.h
+++ b/userspace/falco/configuration.h
@@ -37,7 +37,7 @@ public:
 	{
 		m_path = path;
 		YAML::Node config;
-		std::vector<falco::outputs::config> outputs;
+		std::vector<falco_outputs::output_config> outputs;
 		try
 		{
 			m_root = YAML::LoadFile(path);
@@ -196,7 +196,7 @@ public:
 	bool m_json_output;
 	bool m_json_include_output_property;
 	std::string m_log_level;
-	std::vector<falco::outputs::config> m_outputs;
+	std::vector<falco_outputs::output_config> m_outputs;
 	uint32_t m_notifications_rate;
 	uint32_t m_notifications_max_burst;

@@ -204,7 +204,6 @@ public:

 	bool m_buffered_outputs;
 	bool m_time_format_iso_8601;
-	uint32_t m_output_timeout;

 	bool m_grpc_enabled;
 	uint32_t m_grpc_threadiness;
--- a/userspace/falco/event_drops.cpp
+++ b/userspace/falco/event_drops.cpp
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -15,7 +15,6 @@ limitations under the License.
 */

 #include "event_drops.h"
-#include "falco_common.h"
 #include "banned.h" // This raises a compilation error when certain functions are used

 syscall_evt_drop_mgr::syscall_evt_drop_mgr():
@@ -138,7 +137,7 @@ bool syscall_evt_drop_mgr::perform_actions(uint64_t now, scap_stats &delta, bool

 		case ACT_ALERT:
 			m_outputs->handle_msg(now,
-					      falco_common::PRIORITY_CRITICAL,
+					      falco_outputs::PRIORITY_CRITICAL,
 					      msg,
 					      rule,
 					      output_fields);
--- a/userspace/falco/falco.cpp
+++ b/userspace/falco/falco.cpp
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -36,7 +36,7 @@ limitations under the License.
 #include "logger.h"
 #include "utils.h"
 #include "chisel.h"
-#include "fields_info.h"
+#include "sysdig.h"

 #include "event_drops.h"
 #include "configuration.h"
@@ -762,7 +762,8 @@ int falco_init(int argc, char **argv)
 			}
 		}

-		outputs = new falco_outputs();
+		outputs = new falco_outputs(engine);
+		outputs->set_inspector(inspector);

 		// Some combinations of arguments are not allowed.
 		if (daemon && pidfilename == "") {
@@ -794,7 +795,7 @@ int falco_init(int argc, char **argv)
 				}
 				else
 				{
-					throw std::invalid_argument("You must create a config file at " FALCO_SOURCE_CONF_FILE ", " FALCO_INSTALL_CONF_FILE " or by passing -c\n");
+					conf_filename = "";
 				}
 			}
 		}
@@ -836,7 +837,12 @@ int falco_init(int argc, char **argv)
 		}
 		else
 		{
-			throw std::runtime_error("Could not find configuration file at " + conf_filename);
+			config.init(cmdline_options);
+			falco_logger::set_time_format_iso_8601(config.m_time_format_iso_8601);
+
+			// log after config init because config determines where logs go
+			falco_logger::log(LOG_INFO, "Falco version " + std::string(FALCO_VERSION) + " (driver version " + std::string(DRIVER_VERSION) + ")\n");
+			falco_logger::log(LOG_INFO, "Falco initialized. No configuration file found, proceeding with defaults\n");
 		}

 		if (rules_filenames.size())
@@ -965,13 +971,14 @@ int falco_init(int argc, char **argv)
 			hostname = c_hostname;
 		}

+
 		outputs->init(config.m_json_output,
 			      config.m_json_include_output_property,
-			      config.m_output_timeout,
 			      config.m_notifications_rate, config.m_notifications_max_burst,
 			      config.m_buffered_outputs,
 			      config.m_time_format_iso_8601,
-			      hostname);
+			      hostname,
+			      alternate_lua_dir);

 		if(!all_events)
 		{
--- a/userspace/falco/falco_outputs.cpp
+++ b/userspace/falco/falco_outputs.cpp
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -24,22 +24,24 @@ limitations under the License.

 #include "formats.h"
 #include "logger.h"
-#include "watchdog.h"
-
-#include "outputs_file.h"
-#include "outputs_program.h"
-#include "outputs_stdout.h"
-#include "outputs_syslog.h"
 #ifndef MINIMAL_BUILD
-#include "outputs_http.h"
-#include "outputs_grpc.h"
+#include "falco_outputs_queue.h"
 #endif
-
 #include "banned.h" // This raises a compilation error when certain functions are used

 using namespace std;

-falco_outputs::falco_outputs():
+const static struct luaL_reg ll_falco_outputs [] =
+{
+#ifndef MINIMAL_BUILD
+	{"handle_http", &falco_outputs::handle_http},
+	{"handle_grpc", &falco_outputs::handle_grpc},
+#endif
+	{NULL, NULL}
+};
+
+falco_outputs::falco_outputs(falco_engine *engine):
+	m_falco_engine(engine),
 	m_initialized(false),
 	m_buffered(true),
 	m_json_output(false),
@@ -50,37 +52,53 @@ falco_outputs::falco_outputs():

 falco_outputs::~falco_outputs()
 {
+	// Note: The assert()s in this destructor were previously places where
+	//       exceptions were thrown.  C++11 doesn't allow destructors to
+	//       emit exceptions; if they're thrown, they'll trigger a call
+	//       to 'terminate()'.  To maintain similar behavior, the exceptions
+	//       were replace with calls to 'assert()'
 	if(m_initialized)
 	{
-		this->stop_worker();
-		for(auto o : m_outputs)
+		lua_getglobal(m_ls, m_lua_output_cleanup.c_str());
+		if(!lua_isfunction(m_ls, -1))
 		{
-			delete o;
+			falco_logger::log(LOG_ERR, std::string("No function ") + m_lua_output_cleanup + " found. ");
+			assert(nullptr == "Missing lua cleanup function in ~falco_outputs");
+		}
+
+		if(lua_pcall(m_ls, 0, 0, 0) != 0)
+		{
+			const char *lerr = lua_tostring(m_ls, -1);
+			falco_logger::log(LOG_ERR, std::string("lua_pcall failed, err: ") + lerr);
+			assert(nullptr == "lua_pcall failed in ~falco_outputs");
 		}
 	}
 }

 void falco_outputs::init(bool json_output,
-		  bool json_include_output_property,
-		  uint32_t timeout,
-		  uint32_t rate, uint32_t max_burst, bool buffered,
-		  bool time_format_iso_8601, std::string hostname)
+			 bool json_include_output_property,
+			 uint32_t rate, uint32_t max_burst, bool buffered,
+			 bool time_format_iso_8601, string hostname,
+			 const string& alternate_lua_dir)
 {
-	// Cannot be initialized more than one time.
-	if(m_initialized)
+	// The engine must have been given an inspector by now.
+	if(!m_inspector)
 	{
-		throw falco_exception("falco_outputs already initialized");
+		throw falco_exception("No inspector provided");
 	}

 	m_json_output = json_output;

-	// Note that falco_formats is already initialized by the engine,
-	// and the following json options are not used within the engine.
-	// So we can safely update them.
-	falco_formats::s_json_output = json_output;
-	falco_formats::s_json_include_output_property = json_include_output_property;
+	falco_common::init(m_lua_main_filename.c_str(), alternate_lua_dir.c_str());

-	m_timeout = std::chrono::milliseconds(timeout);
+	// Note that falco_formats is added to both the lua state used
+	// by the falco engine as well as the separate lua state used
+	// by falco outputs.
+	falco_formats::init(m_inspector, m_falco_engine, m_ls, json_output, json_include_output_property);
+
+	falco_logger::init(m_ls);
+
+	luaL_openlib(m_ls, "c_outputs", ll_falco_outputs, 0);

 	m_notifications_tb.init(rate, max_burst);

@@ -88,60 +106,43 @@ void falco_outputs::init(bool json_output,
 	m_time_format_iso_8601 = time_format_iso_8601;
 	m_hostname = hostname;

-	m_worker_thread = std::thread(&falco_outputs::worker, this);
-
 	m_initialized = true;
 }

-// This function has to be called after init() since some configuration settings
-// need to be passed to the output plugins. Then, although the worker has started,
-// the worker is still on hold, waiting for a message.
-// Thus it is still safe to call add_output() before any message has been enqueued.
-void falco_outputs::add_output(falco::outputs::config oc)
+void falco_outputs::add_output(output_config oc)
 {
-	if(!m_initialized)
+	uint8_t nargs = 3;
+	lua_getglobal(m_ls, m_lua_add_output.c_str());
+
+	if(!lua_isfunction(m_ls, -1))
 	{
-		throw falco_exception("cannot add output: falco_outputs not initialized yet");
+		throw falco_exception("No function " + m_lua_add_output + " found. ");
+	}
+	lua_pushstring(m_ls, oc.name.c_str());
+	lua_pushnumber(m_ls, (m_buffered ? 1 : 0));
+	lua_pushnumber(m_ls, (m_time_format_iso_8601 ? 1 : 0));
+
+	// If we have options, build up a lua table containing them
+	if(oc.options.size())
+	{
+		nargs = 4;
+		lua_createtable(m_ls, 0, oc.options.size());
+
+		for(auto it = oc.options.cbegin(); it != oc.options.cend(); ++it)
+		{
+			lua_pushstring(m_ls, (*it).second.c_str());
+			lua_setfield(m_ls, -2, (*it).first.c_str());
+		}
 	}

-	falco::outputs::abstract_output *oo;
-
-	if(oc.name == "file")
+	if(lua_pcall(m_ls, nargs, 0, 0) != 0)
 	{
-		oo = new falco::outputs::output_file();
+		const char *lerr = lua_tostring(m_ls, -1);
+		throw falco_exception(string(lerr));
 	}
-	else if(oc.name == "program")
-	{
-		oo = new falco::outputs::output_program();
-	}
-	else if(oc.name == "stdout")
-	{
-		oo = new falco::outputs::output_stdout();
-	}
-	else if(oc.name == "syslog")
-	{
-		oo = new falco::outputs::output_syslog();
-	}
-#ifndef MINIMAL_BUILD
-	else if(oc.name == "http")
-	{
-		oo = new falco::outputs::output_http();
-	}
-	else if(oc.name == "grpc")
-	{
-		oo = new falco::outputs::output_grpc();
-	}
-#endif
-	else
-	{
-		throw falco_exception("Output not supported: " + oc.name);
-	}
-
-	oo->init(oc, m_buffered, m_hostname);
-	m_outputs.push_back(oo);
 }

-void falco_outputs::handle_event(gen_event *evt, string &rule, string &source,
+void falco_outputs::handle_event(gen_event *ev, string &rule, string &source,
 				 falco_common::priority_type priority, string &format)
 {
 	if(!m_notifications_tb.claim())
@@ -150,96 +151,70 @@ void falco_outputs::handle_event(gen_event *evt, string &rule, string &source,
 		return;
 	}

-	falco_outputs::ctrl_msg cmsg = {};
-	cmsg.ts = evt->get_ts();
-	cmsg.priority = priority;
-	cmsg.source = source;
-	cmsg.rule = rule;
+	std::lock_guard<std::mutex> guard(m_ls_semaphore);
+	lua_getglobal(m_ls, m_lua_output_event.c_str());

-	string sformat;
-	if(source == "syscall")
+	if(lua_isfunction(m_ls, -1))
 	{
-		if(m_time_format_iso_8601)
+		lua_pushlightuserdata(m_ls, ev);
+		lua_pushstring(m_ls, rule.c_str());
+		lua_pushstring(m_ls, source.c_str());
+		lua_pushstring(m_ls, falco_common::priority_names[priority].c_str());
+		lua_pushnumber(m_ls, priority);
+		lua_pushstring(m_ls, format.c_str());
+		lua_pushstring(m_ls, m_hostname.c_str());
+
+		if(lua_pcall(m_ls, 7, 0, 0) != 0)
 		{
-			sformat = "*%evt.time.iso8601: " + falco_common::priority_names[priority];
-		}
-		else
-		{
-			sformat = "*%evt.time: " + falco_common::priority_names[priority];
+			const char *lerr = lua_tostring(m_ls, -1);
+			string err = "Error invoking function output: " + string(lerr);
+			throw falco_exception(err);
 		}
 	}
 	else
 	{
-		if(m_time_format_iso_8601)
-		{
-			sformat = "*%jevt.time.iso8601: " + falco_common::priority_names[priority];
-		}
-		else
-		{
-			sformat = "*%jevt.time: " + falco_common::priority_names[priority];
-		}
+		throw falco_exception("No function " + m_lua_output_event + " found in lua compiler module");
 	}
-
-	// if format starts with a *, remove it, as we added our own prefix
-	if(format[0] == '*')
-	{
-		sformat += " " + format.substr(1, format.length() - 1);
-	}
-	else
-	{
-		sformat += " " + format;
-	}
-
-	cmsg.msg = falco_formats::format_event(evt, rule, source, falco_common::priority_names[priority], sformat);
-	cmsg.fields = falco_formats::resolve_tokens(evt, source, sformat);
-
-	cmsg.type = ctrl_msg_type::CTRL_MSG_OUTPUT;
-	m_queue.push(cmsg);
 }

-void falco_outputs::handle_msg(uint64_t ts,
+void falco_outputs::handle_msg(uint64_t now,
 			       falco_common::priority_type priority,
 			       std::string &msg,
 			       std::string &rule,
 			       std::map<std::string, std::string> &output_fields)
 {
-	falco_outputs::ctrl_msg cmsg = {};
-	cmsg.ts = ts;
-	cmsg.priority = priority;
-	cmsg.source = "internal";
-	cmsg.rule = rule;
-	cmsg.fields = output_fields;
+	std::string full_msg;

 	if(m_json_output)
 	{
 		nlohmann::json jmsg;

 		// Convert the time-as-nanoseconds to a more json-friendly ISO8601.
-		time_t evttime = ts / 1000000000;
+		time_t evttime = now / 1000000000;
 		char time_sec[20]; // sizeof "YYYY-MM-DDTHH:MM:SS"
 		char time_ns[12];  // sizeof ".sssssssssZ"
 		string iso8601evttime;

 		strftime(time_sec, sizeof(time_sec), "%FT%T", gmtime(&evttime));
-		snprintf(time_ns, sizeof(time_ns), ".%09luZ", ts % 1000000000);
+		snprintf(time_ns, sizeof(time_ns), ".%09luZ", now % 1000000000);
 		iso8601evttime = time_sec;
 		iso8601evttime += time_ns;

 		jmsg["output"] = msg;
-		jmsg["priority"] = falco_common::priority_names[priority];
+		jmsg["priority"] = "Critical";
 		jmsg["rule"] = rule;
 		jmsg["time"] = iso8601evttime;
 		jmsg["output_fields"] = output_fields;

-		cmsg.msg = jmsg.dump();
+		full_msg = jmsg.dump();
 	}
 	else
 	{
 		std::string timestr;
 		bool first = true;

-		sinsp_utils::ts_to_string(ts, &timestr, false, true);
-		cmsg.msg = timestr + ": " + falco_common::priority_names[priority] + " " + msg + " (";
+		sinsp_utils::ts_to_string(now, &timestr, false, true);
+		full_msg = timestr + ": " + falco_common::priority_names[LOG_CRIT] + " " + msg + " (";
 		for(auto &pair : output_fields)
 		{
 			if(first)
@@ -248,95 +223,158 @@ void falco_outputs::handle_msg(uint64_t ts,
 			}
 			else
 			{
-				cmsg.msg += " ";
+				full_msg += " ";
 			}
-			cmsg.msg += pair.first + "=" + pair.second;
+			full_msg += pair.first + "=" + pair.second;
 		}
-		cmsg.msg += ")";
+		full_msg += ")";
 	}

-	cmsg.type = ctrl_msg_type::CTRL_MSG_OUTPUT;
-	m_queue.push(cmsg);
-}
+	std::lock_guard<std::mutex> guard(m_ls_semaphore);
+	lua_getglobal(m_ls, m_lua_output_msg.c_str());
+	if(lua_isfunction(m_ls, -1))
+	{
+		lua_pushstring(m_ls, full_msg.c_str());
+		lua_pushstring(m_ls, falco_common::priority_names[priority].c_str());
+		lua_pushnumber(m_ls, priority);

-void falco_outputs::cleanup_outputs()
-{
-	this->push(falco_outputs::ctrl_msg_type::CTRL_MSG_CLEANUP);
+		if(lua_pcall(m_ls, 3, 0, 0) != 0)
+		{
+			const char *lerr = lua_tostring(m_ls, -1);
+			string err = "Error invoking function output: " + string(lerr);
+			throw falco_exception(err);
+		}
+	}
+	else
+	{
+		throw falco_exception("No function " + m_lua_output_msg + " found in lua compiler module");
+	}
 }

 void falco_outputs::reopen_outputs()
 {
-	this->push(falco_outputs::ctrl_msg_type::CTRL_MSG_REOPEN);
-}
-
-void falco_outputs::stop_worker()
-{
-	watchdog<void *> wd;
-	wd.start([&](void *) -> void {
-		falco_logger::log(LOG_NOTICE, "output channels still blocked, discarding all remaining notifications\n");
-		m_queue.clear();
-		this->push(falco_outputs::ctrl_msg_type::CTRL_MSG_STOP);
-	});
-	wd.set_timeout(m_timeout, nullptr);
-
-	this->push(falco_outputs::ctrl_msg_type::CTRL_MSG_STOP);
-	if(m_worker_thread.joinable())
+	lua_getglobal(m_ls, m_lua_output_reopen.c_str());
+	if(!lua_isfunction(m_ls, -1))
 	{
-		m_worker_thread.join();
+		throw falco_exception("No function " + m_lua_output_reopen + " found. ");
+	}
+
+	if(lua_pcall(m_ls, 0, 0, 0) != 0)
+	{
+		const char *lerr = lua_tostring(m_ls, -1);
+		throw falco_exception(string(lerr));
 	}
 }

-inline void falco_outputs::push(ctrl_msg_type cmt)
+#ifndef MINIMAL_BUILD
+int falco_outputs::handle_http(lua_State *ls)
 {
-	falco_outputs::ctrl_msg cmsg = {};
-	cmsg.type = cmt;
-	m_queue.push(cmsg);
-}
+	CURL *curl = NULL;
+	CURLcode res = CURLE_FAILED_INIT;
+	struct curl_slist *slist1;
+	slist1 = NULL;

-// todo(leogr,leodido): this function is not supposed to throw exceptions, and with "noexcept",
-// the program is terminated if that occurs. Although that's the wanted behavior,
-// we still need to improve the error reporting since some inner functions can throw exceptions.
-void falco_outputs::worker() noexcept
-{
-	watchdog<std::string> wd;
-	wd.start([&](std::string payload) -> void {
-		falco_logger::log(LOG_CRIT, "\"" + payload + "\" output timeout, all output channels are blocked\n");
-	});
-
-	auto timeout = m_timeout;
-
-	falco_outputs::ctrl_msg cmsg;
-	do
+	if(!lua_isstring(ls, -1) ||
+	   !lua_isstring(ls, -2))
 	{
-		// Block until a message becomes available.
-		m_queue.pop(cmsg);
+		lua_pushstring(ls, "Invalid arguments passed to handle_http()");
+		lua_error(ls);
+	}

-		for(const auto o : m_outputs)
+	string url = (char *)lua_tostring(ls, 1);
+	string msg = (char *)lua_tostring(ls, 2);
+
+	curl = curl_easy_init();
+	if(curl)
+	{
+		slist1 = curl_slist_append(slist1, "Content-Type: application/json");
+		curl_easy_setopt(curl, CURLOPT_HTTPHEADER, slist1);
+		curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
+		curl_easy_setopt(curl, CURLOPT_POSTFIELDS, msg.c_str());
+		curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, -1L);
+
+		res = curl_easy_perform(curl);
+
+		if(res != CURLE_OK)
 		{
-			wd.set_timeout(timeout, o->get_name());
-			try
-			{
-				switch(cmsg.type)
-				{
-					case ctrl_msg_type::CTRL_MSG_OUTPUT:
-						o->output(&cmsg);
-						break;
-					case ctrl_msg_type::CTRL_MSG_CLEANUP:
-					case ctrl_msg_type::CTRL_MSG_STOP:
-						o->cleanup();
-						break;
-					case ctrl_msg_type::CTRL_MSG_REOPEN:
-						o->reopen();
-						break;
-					default:
-						falco_logger::log(LOG_DEBUG, "Outputs worker received an unknown message type\n");	
-				}
-			}
-			catch(const exception &e)
-			{
-				falco_logger::log(LOG_ERR, o->get_name() + ": " + string(e.what()) + "\n");
-			}
+			falco_logger::log(LOG_ERR, "libcurl error: " + string(curl_easy_strerror(res)));
 		}
-		wd.cancel_timeout();
-	} while(cmsg.type != ctrl_msg_type::CTRL_MSG_STOP);
+		curl_easy_cleanup(curl);
+		curl = NULL;
+		curl_slist_free_all(slist1);
+		slist1 = NULL;
+	}
+	return 1;
 }
+
+int falco_outputs::handle_grpc(lua_State *ls)
+{
+	// check parameters
+	if(!lua_islightuserdata(ls, -8) ||
+	   !lua_isstring(ls, -7) ||
+	   !lua_isstring(ls, -6) ||
+	   !lua_isstring(ls, -5) ||
+	   !lua_isstring(ls, -4) ||
+	   !lua_istable(ls, -3) ||
+	   !lua_isstring(ls, -2) ||
+	   !lua_istable(ls, -1))
+	{
+		lua_pushstring(ls, "Invalid arguments passed to handle_grpc()");
+		lua_error(ls);
+	}
+
+	falco::outputs::response grpc_res;
+
+	// time
+	gen_event *evt = (gen_event *)lua_topointer(ls, 1);
+	auto timestamp = grpc_res.mutable_time();
+	*timestamp = google::protobuf::util::TimeUtil::NanosecondsToTimestamp(evt->get_ts());
+
+	// rule
+	auto rule = grpc_res.mutable_rule();
+	*rule = (char *)lua_tostring(ls, 2);
+
+	// source
+	falco::schema::source s = falco::schema::source::SYSCALL;
+	string sstr = (char *)lua_tostring(ls, 3);
+	if(!falco::schema::source_Parse(sstr, &s))
+	{
+		lua_pushstring(ls, "Unknown source passed to to handle_grpc()");
+		lua_error(ls);
+	}
+	grpc_res.set_source(s);
+
+	// priority
+	falco::schema::priority p = falco::schema::priority::EMERGENCY;
+	string pstr = (char *)lua_tostring(ls, 4);
+	if(!falco::schema::priority_Parse(pstr, &p))
+	{
+		lua_pushstring(ls, "Unknown priority passed to to handle_grpc()");
+		lua_error(ls);
+	}
+	grpc_res.set_priority(p);
+
+	// output
+	auto output = grpc_res.mutable_output();
+	*output = (char *)lua_tostring(ls, 5);
+
+	// output fields
+	auto &fields = *grpc_res.mutable_output_fields();
+
+	lua_pushnil(ls); // so that lua_next removes it from stack and puts (k, v) on it
+	while(lua_next(ls, 6) != 0)
+	{
+		fields[lua_tostring(ls, -2)] = lua_tostring(ls, -1);
+		lua_pop(ls, 1); // remove value, keep key for lua_next
+	}
+	lua_pop(ls, 1); // pop table
+
+	// hostname
+	auto host = grpc_res.mutable_hostname();
+	*host = (char *)lua_tostring(ls, 7);
+
+	falco::outputs::queue::get().push(grpc_res);
+
+	return 1;
+}
+#endif
--- a/userspace/falco/falco_outputs.h
+++ b/userspace/falco/falco_outputs.h
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -19,52 +19,72 @@ limitations under the License.
 #include <memory>
 #include <map>

+extern "C" {
+#include "lua.h"
+#include "lualib.h"
+#include "lauxlib.h"
+}
+
 #include "gen_filter.h"
 #include "json_evt.h"
 #include "falco_common.h"
 #include "token_bucket.h"
 #include "falco_engine.h"
-#include "outputs.h"
-#include "tbb/concurrent_queue.h"

 //
 // This class acts as the primary interface between a program and the
 // falco output engine. The falco rules engine is implemented by a
 // separate class falco_engine.
 //
-class falco_outputs
+
+class falco_outputs : public falco_common
 {
 public:
-	falco_outputs();
+	falco_outputs(falco_engine *engine);
 	virtual ~falco_outputs();

+	// The way to refer to an output (file, syslog, stdout, etc.)
+	// An output has a name and set of options.
+	struct output_config
+	{
+		std::string name;
+		std::map<std::string, std::string> options;
+	};
+
 	void init(bool json_output,
 		  bool json_include_output_property,
-		  uint32_t timeout,
 		  uint32_t rate, uint32_t max_burst, bool buffered,
-		  bool time_format_iso_8601, std::string hostname);
+		  bool time_format_iso_8601, std::string hostname,
+		  const std::string& alternate_lua_dir);

-	void add_output(falco::outputs::config oc);
+	void add_output(output_config oc);

-	// Format then send the event to all configured outputs (`evt` is an event that has matched some rule).
-	void handle_event(gen_event *evt, std::string &rule, std::string &source,
+	//
+	// ev is an event that has matched some rule. Pass the event
+	// to all configured outputs.
+	//
+	void handle_event(gen_event *ev, std::string &rule, std::string &source,
 			  falco_common::priority_type priority, std::string &format);

-	// Format then send a generic message to all outputs. Not necessarily associated with any event.
+	// Send a generic message to all outputs. Not necessarily associated with any event.
 	void handle_msg(uint64_t now,
 			falco_common::priority_type priority,
 			std::string &msg,
 			std::string &rule,
-			std::map<std::string, std::string> &output_fields);
-
-	void cleanup_outputs();
+			std::map<std::string,std::string> &output_fields);

 	void reopen_outputs();

-private:
-	bool m_initialized;
+#ifndef MINIMAL_BUILD
+	static int handle_http(lua_State *ls);
+	static int handle_grpc(lua_State *ls);
+#endif

-	std::vector<falco::outputs::abstract_output *> m_outputs;
+private:
+
+	falco_engine *m_falco_engine;
+
+	bool m_initialized;

 	// Rate limits notifications
 	token_bucket m_notifications_tb;
@@ -72,28 +92,12 @@ private:
 	bool m_buffered;
 	bool m_json_output;
 	bool m_time_format_iso_8601;
-	std::chrono::milliseconds m_timeout;
 	std::string m_hostname;

-	enum ctrl_msg_type
-	{
-		CTRL_MSG_STOP = 0,
-		CTRL_MSG_OUTPUT = 1,
-		CTRL_MSG_CLEANUP = 2,
-		CTRL_MSG_REOPEN = 3,
-	};
-
-	struct ctrl_msg : falco::outputs::message
-	{
-		ctrl_msg_type type;
-	};
-
-	typedef tbb::concurrent_bounded_queue<ctrl_msg> falco_outputs_cbq;
-
-	falco_outputs_cbq m_queue;
-
-	std::thread m_worker_thread;
-	inline void push(ctrl_msg_type cmt);
-	void worker() noexcept;
-	void stop_worker();
+	std::string m_lua_add_output = "add_output";
+	std::string m_lua_output_event = "output_event";
+	std::string m_lua_output_msg = "output_msg";
+	std::string m_lua_output_cleanup = "output_cleanup";
+	std::string m_lua_output_reopen = "output_reopen";
+	std::string m_lua_main_filename = "output.lua";
 };
--- a/userspace/falco/falco_outputs_queue.h
+++ b/userspace/falco/falco_outputs_queue.h
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors
+Copyright (C) 2019 The Falco Authors

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -21,9 +21,9 @@ limitations under the License.

 namespace falco
 {
-namespace grpc
+namespace outputs
 {
-typedef tbb::concurrent_queue<outputs::response> response_cq;
+typedef tbb::concurrent_queue<response> response_cq;

 class queue
 {
@@ -34,12 +34,12 @@ public:
 		return instance;
 	}

-	bool try_pop(outputs::response& res)
+	bool try_pop(response& res)
 	{
 		return m_queue.try_pop(res);
 	}

-	void push(outputs::response& res)
+	void push(response& res)
 	{
 		m_queue.push(res);
 	}
@@ -56,5 +56,5 @@ public:
 	queue(queue const&) = delete;
 	void operator=(queue const&) = delete;
 };
-} // namespace grpc
+} // namespace output
 } // namespace falco
--- a/userspace/falco/grpc_server_impl.cpp
+++ b/userspace/falco/grpc_server_impl.cpp
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors
+Copyright (C) 2019 The Falco Authors

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -15,9 +15,8 @@ limitations under the License.
 */

 #include "config_falco.h"
-#include "falco_engine_version.h"
 #include "grpc_server_impl.h"
-#include "grpc_queue.h"
+#include "falco_outputs_queue.h"
 #include "logger.h"
 #include "banned.h" // This raises a compilation error when certain functions are used

@@ -45,7 +44,7 @@ void falco::grpc::server_impl::get(const stream_context& ctx, const outputs::req
 	// m_status == stream_context::STREAMING?
 	// todo(leodido) > set m_stream

-	ctx.m_has_more = queue::get().try_pop(res);
+	ctx.m_has_more = outputs::queue::get().try_pop(res);
 }

 void falco::grpc::server_impl::sub(const bidi_context& ctx, const outputs::request& req, outputs::response& res)
@@ -62,7 +61,7 @@ void falco::grpc::server_impl::sub(const bidi_context& ctx, const outputs::reque
 	// m_status == stream_context::STREAMING?
 	// todo(leodido) > set m_stream

-	ctx.m_has_more = queue::get().try_pop(res);
+	ctx.m_has_more = outputs::queue::get().try_pop(res);
 }

 void falco::grpc::server_impl::version(const context& ctx, const version::request&, version::response& res)
@@ -76,9 +75,6 @@ void falco::grpc::server_impl::version(const context& ctx, const version::reques
 	auto& version = *res.mutable_version();
 	version = FALCO_VERSION;

-	res.set_engine_version(FALCO_ENGINE_VERSION);
-	res.set_engine_fields_checksum(FALCO_FIELDS_CHECKSUM); 
-
 	res.set_major(FALCO_VERSION_MAJOR);
 	res.set_minor(FALCO_VERSION_MINOR);
 	res.set_patch(FALCO_VERSION_PATCH);
--- a/userspace/falco/logger.cpp
+++ b/userspace/falco/logger.cpp
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -16,13 +16,25 @@ limitations under the License.

 #include <ctime>
 #include "logger.h"
+#include "chisel_api.h"

 #include "falco_common.h"
 #include "banned.h" // This raises a compilation error when certain functions are used

+const static struct luaL_reg ll_falco [] =
+{
+	{"syslog", &falco_logger::syslog},
+	{NULL,NULL}
+};
+
 int falco_logger::level = LOG_INFO;
 bool falco_logger::time_format_iso_8601 = false;

+void falco_logger::init(lua_State *ls)
+{
+	luaL_openlib(ls, "falco", ll_falco, 0);
+}
+
 void falco_logger::set_time_format_iso_8601(bool val)
 {
 	falco_logger::time_format_iso_8601 = val;
@@ -69,6 +81,19 @@ void falco_logger::set_level(string &level)
 }


+int falco_logger::syslog(lua_State *ls) {
+	int priority = luaL_checknumber(ls, 1);
+
+	if (priority > LOG_DEBUG) {
+		return luaL_argerror(ls, 1, "falco.syslog: priority must be a number between 0 and 7");
+	}
+
+	const char *msg = luaL_checkstring(ls, 2);
+	::syslog(priority, "%s", msg);
+
+	return 0;
+}
+
 bool falco_logger::log_stderr = true;
 bool falco_logger::log_syslog = true;

--- a/userspace/falco/logger.h
+++ b/userspace/falco/logger.h
@@ -1,5 +1,5 @@
 /*
-Copyright (C) 2020 The Falco Authors.
+Copyright (C) 2019 The Falco Authors.

 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -19,15 +19,25 @@ limitations under the License.
 #include "sinsp.h"
 #include <syslog.h>

+extern "C" {
+#include "lua.h"
+#include "lualib.h"
+#include "lauxlib.h"
+}
+
 class falco_logger
 {
 public:
+	static void init(lua_State *ls);

 	static void set_time_format_iso_8601(bool val);

 	// Will throw exception if level is unknown.
 	static void set_level(string &level);

+	// value = falco.syslog(level, message)
+	static int syslog(lua_State *ls);
+
 	static void log(int priority, const string msg);

 	static int level;
--- a/userspace/falco/lua/.gitignore
+++ b/userspace/falco/lua/.gitignore
@@ -0,0 +1 @@
+lyaml*
--- a/userspace/falco/lua/output.lua
+++ b/userspace/falco/lua/output.lua
@@ -0,0 +1,271 @@
+-- Copyright (C) 2019 The Falco Authors.
+--
+-- Licensed under the Apache License, Version 2.0 (the "License");
+-- you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+--     http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+
+local mod = {}
+
+local outputs = {}
+
+function mod.stdout(event, rule, source, priority, priority_num, msg, format, hostname, options)
+   mod.stdout_message(priority, priority_num, msg, options)
+end
+
+function mod.stdout_message(priority, priority_num, msg, options)
+   if options.buffered == 0 then
+      io.stdout:setvbuf "no"
+   end
+   print(msg)
+end
+
+function mod.stdout_cleanup()
+   io.stdout:flush()
+end
+
+-- Note: not actually closing/reopening stdout
+function mod.stdout_reopen(options)
+end
+
+function mod.file_validate(options)
+   if (not type(options.filename) == "string") then
+      error("File output needs to be configured with a valid filename")
+   end
+
+   local file, err = io.open(options.filename, "a+")
+   if file == nil then
+      error("Error with file output: " .. err)
+   end
+   file:close()
+end
+
+function mod.file_open(options)
+   if ffile == nil then
+      ffile = io.open(options.filename, "a+")
+      if options.buffered == 0 then
+         ffile:setvbuf "no"
+      end
+   end
+end
+
+function mod.file(event, rule, source, priority, priority_num, msg, format, hostname, options)
+   mod.file_message(priority, priority_num, msg, options)
+end
+
+function mod.file_message(priority, priority_num, msg, options)
+   if options.keep_alive == "true" then
+      mod.file_open(options)
+   else
+      ffile = io.open(options.filename, "a+")
+   end
+
+   ffile:write(msg, "\n")
+
+   if options.keep_alive == nil or options.keep_alive ~= "true" then
+      ffile:close()
+      ffile = nil
+   end
+end
+
+function mod.file_cleanup()
+   if ffile ~= nil then
+      ffile:flush()
+      ffile:close()
+      ffile = nil
+   end
+end
+
+function mod.file_reopen(options)
+   if options.keep_alive == "true" then
+      mod.file_cleanup()
+      mod.file_open(options)
+   end
+end
+
+function mod.syslog(event, rule, source, priority, priority_num, msg, format, hostname, options)
+   mod.syslog_message(priority, priority_num, msg, options)
+end
+
+function mod.syslog_message(priority, priority_num, msg, options)
+   falco.syslog(priority_num, msg)
+end
+
+function mod.syslog_cleanup()
+end
+
+function mod.syslog_reopen()
+end
+
+function mod.program_open(options)
+   if pfile == nil then
+      pfile = io.popen(options.program, "w")
+      if options.buffered == 0 then
+         pfile:setvbuf "no"
+      end
+   end
+end
+
+function mod.program(event, rule, source, priority, priority_num, msg, format, hostname, options)
+   mod.program_message(priority, priority_num, msg, options)
+end
+
+function mod.program_message(priority, priority_num, msg, options)
+   -- XXX Ideally we'd check that the program ran
+   -- successfully. However, the luajit we're using returns true even
+   -- when the shell can't run the program.
+
+   -- Note: options are all strings
+   if options.keep_alive == "true" then
+      mod.program_open(options)
+   else
+      pfile = io.popen(options.program, "w")
+   end
+
+   pfile:write(msg, "\n")
+
+   if options.keep_alive == nil or options.keep_alive ~= "true" then
+      pfile:close()
+      pfile = nil
+   end
+end
+
+function mod.program_cleanup()
+   if pfile ~= nil then
+      pfile:flush()
+      pfile:close()
+      pfile = nil
+   end
+end
+
+function mod.program_reopen(options)
+   if options.keep_alive == "true" then
+      mod.program_cleanup()
+      mod.program_open(options)
+   end
+end
+
+function mod.http(event, rule, source, priority, priority_num, msg, format, hostname, options)
+   mod.http_message(priority, priority_num, msg, options)
+end
+
+function mod.http_message(priority, priority_num, msg, options)
+   c_outputs.handle_http(options.url, msg)
+end
+
+function mod.http_cleanup()
+end
+
+function mod.http_reopen()
+end
+
+function mod.grpc(event, rule, source, priority, priority_num, msg, format, hostname, options)
+   fields = formats.resolve_tokens(event, source, format)
+   c_outputs.handle_grpc(event, rule, source, priority, msg, fields, hostname, options)
+end
+
+function mod.grpc_message(priority, priority_num, msg, options)
+   -- todo(fntlnz, leodido) > gRPC does not support subscribing to dropped events yet
+end
+
+
+function mod.grpc_cleanup()
+end
+
+function mod.grpc_reopen()
+end
+
+function output_event(event, rule, source, priority, priority_num, format, hostname)
+   -- If format starts with a *, remove it, as we're adding our own
+   -- prefix here.
+   if format:sub(1, 1) == "*" then
+      format = format:sub(2)
+   end
+
+   -- time_format_iso_8601 will be the same for all output channels
+   time_format_iso_8601 = 0
+
+   for index, o in ipairs(outputs) do
+      time_format_iso_8601 = o.options.time_format_iso_8601
+      break
+   end
+
+   if source == "syscall" then
+      if time_format_iso_8601 == 1 then
+         format = "*%evt.time.iso8601: " .. priority .. " " .. format
+      else
+         format = "*%evt.time: " .. priority .. " " .. format
+      end
+   else
+      if time_format_iso_8601 == 1 then
+         format = "*%jevt.time.iso8601: " .. priority .. " " .. format
+      else
+         format = "*%jevt.time: " .. priority .. " " .. format
+      end
+   end
+
+   msg = formats.format_event(event, rule, source, priority, format)
+
+   for index, o in ipairs(outputs) do
+      o.output(event, rule, source, priority, priority_num, msg, format, hostname, o.options)
+   end
+end
+
+function output_msg(msg, priority, priority_num)
+   for index, o in ipairs(outputs) do
+      o.message(priority, priority_num, msg, o.options)
+   end
+end
+
+function output_cleanup()
+   formats.free_formatters()
+   for index, o in ipairs(outputs) do
+      o.cleanup()
+   end
+end
+
+function output_reopen()
+   for index, o in ipairs(outputs) do
+      o.reopen(o.options)
+   end
+end
+
+function add_output(output_name, buffered, time_format_iso_8601, options)
+   if not (type(mod[output_name]) == "function") then
+      error("rule_loader.add_output(): invalid output_name: " .. output_name)
+   end
+
+   -- outputs can optionally define a validation function so that we don't
+   -- find out at runtime (when an event finally matches a rule!) that the options are invalid
+   if (type(mod[output_name .. "_validate"]) == "function") then
+      mod[output_name .. "_validate"](options)
+   end
+
+   if options == nil then
+      options = {}
+   end
+
+   options.buffered = buffered
+   options.time_format_iso_8601 = time_format_iso_8601
+
+   table.insert(
+      outputs,
+      {
+         output = mod[output_name],
+         cleanup = mod[output_name .. "_cleanup"],
+         reopen = mod[output_name .. "_reopen"],
+         message = mod[output_name .. "_message"],
+         options = options
+      }
+   )
+end
+
+return mod
--- a/userspace/falco/lua/test.lua
+++ b/userspace/falco/lua/test.lua
@@ -0,0 +1,44 @@
+-- Copyright (C) 2019 The Falco Authors.
+--
+-- Licensed under the Apache License, Version 2.0 (the "License");
+-- you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+--     http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+
+local parser = require "parser"
+
+if #arg ~= 1 then
+    print("Usage: test.lua <string>")
+    os.exit(1)
+end
+
+local macros = {}
+local ast
+
+local function doit(line)
+   ast = parser.parse_filter(line)
+
+   if not ast then
+      print("error", error_msg)
+      os.exit(1)
+   end
+
+end
+for str in string.gmatch(arg[1], "([^;]+)") do
+   doit(str)
+end
+
+if (ast and ast.type) then
+   parser.print_ast(ast)
+end
+
+os.exit(0)
+
--- a/userspace/falco/outputs.h
+++ b/userspace/falco/outputs.h
@@ -1,94 +0,0 @@
-/*
-Copyright (C) 2020 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#pragma once
-
-#include <string>
-#include <map>
-
-#include "falco_common.h"
-#include "gen_filter.h"
-
-namespace falco
-{
-namespace outputs
-{
-
-//
-// The way to refer to an output (file, syslog, stdout, etc.)
-// An output has a name and set of options.
-//
-struct config
-{
-	std::string name;
-	std::map<std::string, std::string> options;
-};
-
-//
-// The message to be outputted. It can either refer to:
-//  - an event that has matched some rule,
-//  - or a generic message (e.g., a drop alert).
-//
-struct message
-{
-	uint64_t ts;
-	falco_common::priority_type priority;
-	std::string msg;
-	std::string rule;
-	std::string source;
-	map<std::string, std::string> fields;
-};
-
-//
-// This class acts as the primary interface for implementing
-// a Falco output class.
-//
-
-class abstract_output
-{
-public:
-	virtual ~abstract_output() {}
-
-	void init(config oc, bool buffered, std::string hostname)
-	{
-		m_oc = oc;
-		m_buffered = buffered;
-		m_hostname = hostname;
-	}
-
-	// Return the output's name as per its configuration.
-	const std::string get_name() const
-	{
-		return m_oc.name;
-	}
-
-	// Output a message.
-	virtual void output(const message *msg) = 0;
-
-	// Possibly close the output and open it again.
-	virtual void reopen() {}
-
-	// Possibly flush the output.
-	virtual void cleanup() {}
-
-protected:
-	config m_oc;
-	bool m_buffered;
-	std::string m_hostname;
-};
-
-} // namespace outputs
-} // namespace falco
--- a/userspace/falco/outputs_file.cpp
+++ b/userspace/falco/outputs_file.cpp
@@ -1,57 +0,0 @@
-/*
-Copyright (C) 2020 The Falco Authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include "outputs_file.h"
-#include <iostream>
-#include <fstream>
-#include "banned.h" // This raises a compilation error when certain functions are used
-
-void falco::outputs::output_file::open_file()
-{
-	if(!m_buffered)
-	{
-		m_outfile.rdbuf()->pubsetbuf(0, 0);
-	}
-	if(!m_outfile.is_open())
-	{
-		m_outfile.open(m_oc.options["filename"], fstream::app);
-	}
-}
-
-void falco::outputs::output_file::output(const message *msg)
-{
-	open_file();
-	m_outfile << msg->msg + "\n";
-
-	if(m_oc.options["keep_alive"] != "true")
-	{
-		cleanup();
-	}
-}
-
-void falco::outputs::output_file::cleanup()
-{
-	if(m_outfile.is_open())
-	{
-		m_outfile.close();
-	}
-}
-
-void falco::outputs::output_file::reopen()
-{
-	cleanup();
-	open_file();
-}
--- a/userspace/falco/outputs_file.h
+++ b/userspace/falco/outputs_file.h
@@ -1,43 +0,0 @@
-/*
-Copyright (C) 2020 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#pragma once
-
-#include "outputs.h"
-#include <iostream>
-#include <fstream>
-
-namespace falco
-{
-namespace outputs
-{
-
-class output_file : public abstract_output
-{
-	void output(const message *msg);
-
-	void cleanup();
-
-	void reopen();
-
-private:
-	void open_file();
-
-	std::ofstream m_outfile;
-};
-
-} // namespace outputs
-} // namespace falco
--- a/userspace/falco/outputs_grpc.cpp
+++ b/userspace/falco/outputs_grpc.cpp
@@ -1,68 +0,0 @@
-/*
-Copyright (C) 2020 The Falco Authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include <google/protobuf/util/time_util.h>
-#include "outputs_grpc.h"
-#include "grpc_queue.h"
-#include "falco_common.h"
-#include "formats.h"
-#include "banned.h" // This raises a compilation error when certain functions are used
-
-void falco::outputs::output_grpc::output(const message *msg)
-{
-	falco::outputs::response grpc_res;
-
-	// time
-	auto timestamp = grpc_res.mutable_time();
-	*timestamp = google::protobuf::util::TimeUtil::NanosecondsToTimestamp(msg->ts);
-
-	// rule
-	auto r = grpc_res.mutable_rule();
-	*r = msg->rule;
-
-	// source
-	falco::schema::source s = falco::schema::source::SYSCALL;
-	if(!falco::schema::source_Parse(msg->source, &s))
-	{
-		throw falco_exception("Unknown source passed to output_grpc::output()");
-	}
-	grpc_res.set_source(s);
-
-	// priority
-	falco::schema::priority p = falco::schema::priority::EMERGENCY;
-	if(!falco::schema::priority_Parse(falco_common::priority_names[msg->priority], &p))
-	{
-		throw falco_exception("Unknown priority passed to output_grpc::output()");
-	}
-	grpc_res.set_priority(p);
-
-	// output
-	auto output = grpc_res.mutable_output();
-	*output = msg->msg;
-
-	// output fields
-	auto &fields = *grpc_res.mutable_output_fields();
-	for(const auto &kv : msg->fields)
-	{
-		fields[kv.first] = kv.second;
-	}
-
-	// hostname
-	auto host = grpc_res.mutable_hostname();
-	*host = m_hostname;
-
-	falco::grpc::queue::get().push(grpc_res);
-}
--- a/userspace/falco/outputs_grpc.h
+++ b/userspace/falco/outputs_grpc.h
@@ -1,32 +0,0 @@
-/*
-Copyright (C) 2020 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#pragma once
-
-#include "outputs.h"
-
-namespace falco
-{
-namespace outputs
-{
-
-class output_grpc : public abstract_output
-{
-	void output(const message *msg);
-};
-
-} // namespace outputs
-} // namespace falco
--- a/userspace/falco/outputs_http.cpp
+++ b/userspace/falco/outputs_http.cpp
@@ -1,48 +0,0 @@
-/*
-Copyright (C) 2020 The Falco Authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include "outputs_http.h"
-#include "logger.h"
-#include "banned.h" // This raises a compilation error when certain functions are used
-
-void falco::outputs::output_http::output(const message *msg)
-{
-	CURL *curl = NULL;
-	CURLcode res = CURLE_FAILED_INIT;
-	struct curl_slist *slist1;
-	slist1 = NULL;
-
-	curl = curl_easy_init();
-	if(curl)
-	{
-		slist1 = curl_slist_append(slist1, "Content-Type: application/json");
-		curl_easy_setopt(curl, CURLOPT_HTTPHEADER, slist1);
-		curl_easy_setopt(curl, CURLOPT_URL, m_oc.options["url"].c_str());
-		curl_easy_setopt(curl, CURLOPT_POSTFIELDS, msg->msg.c_str());
-		curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, -1L);
-
-		res = curl_easy_perform(curl);
-
-		if(res != CURLE_OK)
-		{
-			falco_logger::log(LOG_ERR, "libcurl error: " + string(curl_easy_strerror(res)));
-		}
-		curl_easy_cleanup(curl);
-		curl = NULL;
-		curl_slist_free_all(slist1);
-		slist1 = NULL;
-	}
-}
--- a/userspace/falco/outputs_http.h
+++ b/userspace/falco/outputs_http.h
@@ -1,32 +0,0 @@
-/*
-Copyright (C) 2020 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#pragma once
-
-#include "outputs.h"
-
-namespace falco
-{
-namespace outputs
-{
-
-class output_http : public abstract_output
-{
-	void output(const message *msg);
-};
-
-} // namespace outputs
-} // namespace falco
--- a/userspace/falco/outputs_program.cpp
+++ b/userspace/falco/outputs_program.cpp
@@ -1,59 +0,0 @@
-/*
-Copyright (C) 2020 The Falco Authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include "outputs_program.h"
-#include <stdio.h>
-#include "banned.h" // This raises a compilation error when certain functions are used
-
-void falco::outputs::output_program::open_pfile()
-{
-	if(m_pfile == nullptr)
-	{
-		m_pfile = popen(m_oc.options["program"].c_str(), "w");
-
-		if(!m_buffered)
-		{
-			setvbuf(m_pfile, NULL, _IONBF, 0);
-		}
-	}
-}
-
-void falco::outputs::output_program::output(const message *msg)
-{
-	open_pfile();
-
-	fprintf(m_pfile, "%s\n", msg->msg.c_str());
-
-	if(m_oc.options["keep_alive"] != "true")
-	{
-		cleanup();
-	}
-}
-
-void falco::outputs::output_program::cleanup()
-{
-	if(m_pfile != nullptr)
-	{
-		pclose(m_pfile);
-		m_pfile = nullptr;
-	}
-}
-
-void falco::outputs::output_program::reopen()
-{
-	cleanup();
-	open_pfile();
-}
--- a/userspace/falco/outputs_program.h
+++ b/userspace/falco/outputs_program.h
@@ -1,41 +0,0 @@
-/*
-Copyright (C) 2020 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#pragma once
-
-#include "outputs.h"
-
-namespace falco
-{
-namespace outputs
-{
-
-class output_program : public abstract_output
-{
-	void output(const message *msg);
-
-	void cleanup();
-
-	void reopen();
-
-private:
-	void open_pfile();
-
-	FILE *m_pfile;
-};
-
-} // namespace outputs
-} // namespace falco
--- a/userspace/falco/outputs_stdout.cpp
+++ b/userspace/falco/outputs_stdout.cpp
@@ -1,39 +0,0 @@
-/*
-Copyright (C) 2020 The Falco Authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include "outputs_stdout.h"
-#include <iostream>
-#include "banned.h" // This raises a compilation error when certain functions are used
-
-void falco::outputs::output_stdout::output(const message *msg)
-{
-	//
-	// By default, the stdout stream is fully buffered or line buffered
-	// (if the stream can be determined to refer to an interactive device, e.g. in a TTY).
-	// Just enable automatic flushing when unbuffered output is desired.
-	// Note that it is set every time since other writings to the stdout can disable it.
-	//
-	if(!m_buffered)
-	{
-		std::cout << std::unitbuf;
-	}
-	std::cout << msg->msg + "\n";
-}
-
-void falco::outputs::output_stdout::cleanup()
-{
-	std::cout.flush();
-}
--- a/userspace/falco/outputs_stdout.h
+++ b/userspace/falco/outputs_stdout.h
@@ -1,34 +0,0 @@
-/*
-Copyright (C) 2020 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#pragma once
-
-#include "outputs.h"
-
-namespace falco
-{
-namespace outputs
-{
-
-class output_stdout : public abstract_output
-{
-	void output(const message *msg);
-
-	void cleanup();
-};
-
-} // namespace outputs
-} // namespace falco
--- a/userspace/falco/outputs_syslog.cpp
+++ b/userspace/falco/outputs_syslog.cpp
@@ -1,25 +0,0 @@
-/*
-Copyright (C) 2020 The Falco Authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include "outputs_syslog.h"
-#include <syslog.h>
-#include "banned.h" // This raises a compilation error when certain functions are used
-
-void falco::outputs::output_syslog::output(const message *msg)
-{
-	// Syslog output should not have any trailing newline
-	::syslog(msg->priority, "%s", msg->msg.c_str());
-}
--- a/userspace/falco/outputs_syslog.h
+++ b/userspace/falco/outputs_syslog.h
@@ -1,32 +0,0 @@
-/*
-Copyright (C) 2020 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#pragma once
-
-#include "outputs.h"
-
-namespace falco
-{
-namespace outputs
-{
-
-class output_syslog : public abstract_output
-{
-	void output(const message *msg);
-};
-
-} // namespace outputs
-} // namespace falco
--- a/userspace/falco/schema.proto
+++ b/userspace/falco/schema.proto
@@ -57,7 +57,4 @@ enum source {
  k8s_audit = 1;
  K8s_audit = 1;
  K8S_audit = 1;
-  INTERNAL = 2;
-  internal = 2;
-  Internal = 2;
 }
--- a/userspace/falco/version.proto
+++ b/userspace/falco/version.proto
@@ -36,14 +36,10 @@ message request
 // its parts as per semver 2.0 specification (https://semver.org).
 message response
 {
-// falco version
  string version = 1;
  uint32 major = 2;
  uint32 minor = 3;
  uint32 patch = 4;
  string prerelease = 5;
  string build = 6;
-// falco engine version
-  uint32 engine_version = 7;
-  string engine_fields_checksum = 8;
-}
+}
--- a/userspace/falco/watchdog.h
+++ b/userspace/falco/watchdog.h
@@ -1,96 +0,0 @@
-/*
-Copyright (C) 2020 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include <chrono>
-#include <thread>
-#include <functional>
-#include <atomic>
-
-template<typename _T>
-class watchdog
-{
-public:
-	watchdog():
-		m_timeout(nullptr),
-		m_is_running(false)
-	{
-	}
-
-	~watchdog()
-	{
-		stop();
-	}
-
-	void start(std::function<void(_T)> cb,
-		   std::chrono::milliseconds resolution = std::chrono::milliseconds(100))
-	{
-		stop();
-		m_is_running.store(true, std::memory_order_release);
-		m_thread = std::thread([this, cb, resolution]() {
-			const auto no_deadline = time_point{};
-			timeout_data curr;
-			while(m_is_running.load(std::memory_order_acquire))
-			{
-				auto t = m_timeout.exchange(nullptr, std::memory_order_release);
-				if(t)
-				{
-					curr = *t;
-					delete t;
-				}
-				if(curr.deadline != no_deadline && curr.deadline < std::chrono::steady_clock::now())
-				{
-					cb(curr.payload);
-					curr.deadline = no_deadline;
-				}
-				std::this_thread::sleep_for(resolution);
-			}
-		});
-	}
-
-	void stop()
-	{
-		if(m_is_running.load(std::memory_order_acquire))
-		{
-			m_is_running.store(false, std::memory_order_release);
-			if(m_thread.joinable())
-			{
-				m_thread.join();
-			}
-			delete m_timeout.exchange(nullptr, std::memory_order_release);
-		}
-	}
-
-	inline void set_timeout(std::chrono::milliseconds timeout, _T payload) noexcept
-	{
-		delete m_timeout.exchange(new timeout_data{std::chrono::steady_clock::now() + timeout, payload}, std::memory_order_release);
-	}
-
-	inline void cancel_timeout() noexcept
-	{
-		delete m_timeout.exchange(new timeout_data, std::memory_order_release);
-	}
-
-private:
-	typedef std::chrono::time_point<std::chrono::steady_clock> time_point;
-	struct timeout_data
-	{
-		time_point deadline;
-		_T payload;
-	};
-	std::atomic<timeout_data *> m_timeout;
-	std::atomic<bool> m_is_running;
-	std::thread m_thread;
-};