chore(unit_tests/engine): capture feature testing

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

cmake/modules/falcosecurity-libs.cmake

@@ -42,9 +42,9 @@ else()
 	# version (or branch, or commit) just pass the variable - ie., `cmake
 	# -DFALCOSECURITY_LIBS_VERSION=dev ..`
 	if(NOT FALCOSECURITY_LIBS_VERSION)
-		set(FALCOSECURITY_LIBS_VERSION "7b08f8a0a12b56d59eab73052e637ca123623f61")
+		set(FALCOSECURITY_LIBS_VERSION "362b1709f4dee99c91f72e551120b3f8cdf0e508")
 		set(FALCOSECURITY_LIBS_CHECKSUM
-			"SHA256=43c72a98e48d04177c8223ccdfe88de6f09958f2330b6b9ee26882f1a77e369f"
+			"SHA256=833c3d706ce3cfeb45e17216509a1270d33bca26552326737f66d43fdad30b3d"
 		)
 	endif()
 

falco.yaml

@@ -461,11 +461,19 @@ engine:
 # 2. `all_rules`: Captures events when any enabled rule is triggered.
 #
 # When a capture starts, Falco records events from the moment the triggering rule
-# fires until the deadline is reached. The deadline is determined by the rule's
-# `capture_duration` if specified, otherwise the `default_duration` is used.
-# If additional rules trigger during an active capture, the deadline is extended
-# accordingly. Once the deadline expires, the capture stops and data is written
-# to a file. Subsequent captures create new files with unique names.
+# fires until a stop condition is reached. The stop conditions are:
+# - Duration: determined by the rule's `capture_duration` if specified, otherwise
+#   the `default_duration` is used.
+# - Event count: determined by the rule's `capture_events` if specified, otherwise
+#   the `default_events` is used.
+# - File size: determined by the rule's `capture_filesize` if specified, otherwise
+#   the `default_filesize` is used.
+#
+# When multiple stop conditions are configured, the first one reached wins (OR
+# semantics). If additional rules trigger during an active capture, the limits
+# are extended accordingly. Once a stop condition is met, the capture stops and
+# data is written to a file. Subsequent captures create new files with unique
+# names.
 #
 # Captured data is stored in files with a `.scap` extension, which can be
 # analyzed later using:
@@ -483,12 +491,15 @@ engine:
 # Use `capture.mode` to choose between `rules` and `all_rules` modes.
 #
 # Set `capture.default_duration` to define the default capture duration
-# in milliseconds.
+# in milliseconds. Optionally, set `capture.default_events` to limit the
+# number of captured events, and `capture.default_filesize` to limit the
+# capture file size in kB.
 #
 # --- [Suggestions]
 #
 # When using `mode: rules`, configure individual rules to enable capture by
-# adding `capture: true` and optionally `capture_duration` to specific rules.
+# adding `capture: true` and optionally `capture_duration`, `capture_events`,
+# and/or `capture_filesize` to specific rules.
 # For example:
 #
 # - rule: Suspicious File Access
@@ -512,6 +523,10 @@ capture:
   mode: rules
   # -- Default capture duration in milliseconds if not specified in the rule.
   default_duration: 5000
+  # -- Default maximum number of captured events (0 = unlimited).
+  # default_events: 0
+  # -- Default maximum capture file size in kB (0 = unlimited).
+  # default_filesize: 0
 
 #################
 # Falco plugins #

proposals/20251205-multi-thread-falco-design.md

@@ -1,186 +0,0 @@
-# Multi-Threaded Falco High-Level Design (Working draft)
-
-## Summary
-
-This document outlines a high-level design for implementing multi-threading in Falco. The goal of this proposal is to overcome Falco's single-threaded architecture to improve scalability in scenarios where the amount of events produced cannot be processed in a single thread. This is achieved by leveraging multiple threads for event processing, rule evaluation, and output handling, enabling Falco to better utilize multi-core systems and reduce event drops under high event rates.
-
-## Goals
-
-* Address the problems related to single CPU core saturation, leading to dropped events.
-* Minimize the performance impact on the single threaded usage, that remains the default. 
-
-## Non-Goals
-
-* This document does not cover low-level implementation details that will be addressed in specific design documents for each component or directly in the implementation phase.
-* This document does not focus on performance optimization, the primary goal is scalability improvements to handle higher event rates that exceed single-thread processing capacity.
-
-## Success Metrics
-
-The success of this multi-threading initiative will be measured by the following key metrics:
-
-* **Event Drop Rate Reduction**: The primary success metric is the reduction in event drops under high event rates. A successful implementation should significantly reduce or eliminate event drops that occur when a single thread cannot keep up with the event rate.
-* **Throughput Scaling**: The system should demonstrate improved throughput (events processed per second) that scales with the number of worker threads, up to a reasonable limit based on available CPU cores and workload characteristics.
-* **CPU Utilization**: Multi-threaded Falco should better utilize available CPU cores, with worker threads distributing load across multiple cores instead of saturating a single core.
-* **Single-Threaded Performance Preservation**: The single-threaded mode (default) should maintain its current performance characteristics, with minimal or no performance regression when multi-threading is disabled.
-
-These metrics will be evaluated through benchmarking and real-world deployment scenarios to validate that the multi-threaded architecture achieves its scalability goals without compromising correctness or introducing significant overhead.
-
-## High-Level Design
-
-### Current Architecture
-
-![Current Falco Architecture](images/falco-architecture.png)
-
-* The kernel driver (via kmod or eBPF) writes events into per-CPU ring buffers. Each CPU has its own buffer to avoid lock contention. We have a ring buffer per CPU core, and a single userspace.
-* Userspace (libscap) performs an `O(n_cpus)` scan on every next() call, it peeks at the head event from each ring buffer, finds the event with the minimum timestamp across all buffers and returns that event to Falco for processing. The consumer position is only advanced after the event has been consumed (on the next call), ensuring the caller can safely read the event data and avoiding the need to perform copies of the event data.
-* Libsinsp processes the events sequentially as they are received from libscap, building a stateful representation of the system and providing the necessary context for rule evaluation.
-* Falco evaluates the rules against the processed events and generates alerts based on the defined security policies.
-
-### Proposed Architecture Overview
-
-![Multi-Threaded Falco Architecture](images/falco-multi-thread-architecture.png)
-
-* The kernel driver (modern eBPF probe) routes events into per-partition ring buffers based on TGID. The routing logic executes in kernel space (within the eBPF program), where each event's TGID is hashed and used to select the target ring buffer. Only the modern eBPF probe is supported, as it relies on [BPF_MAP_TYPE_RINGBUF](https://docs.ebpf.io/linux/map-type/BPF_MAP_TYPE_RINGBUF/) which does not have a per-CPU design as opposed to the `BPF_MAP_TYPE_PERF_EVENT_ARRAY` used by the legacy eBPF probe.
-* Each ring buffer is associated with an event loop worker thread that processes events from its assigned ring buffer.
-* The `libsinsp` state (e.g., the thread state) is maintained in a shared data structure, allowing all workers to access data pushed by other workers. This is crucial for handling events like clone() that rely on data written by other partitions. This requires designing lightweight synchronization mechanisms to ensure efficient access to shared state without introducing significant contention. A dedicated proposal document will address the design of the shared state and synchronization mechanisms, and data consistency.
-* Falco's rule evaluation is performed in parallel by multiple worker threads, each evaluating rules against the events they process. Current Falco plugins are not supposed to be thread-safe. A dedicated proposal document will address the design of a thread-safe plugin architecture.
-* **Output handling** is already designed for multi-threaded access. The `falco_outputs` class implements a thread-safe, queue-based architecture using Intel TBB's `concurrent_bounded_queue`, which is specifically designed for multi-producer, single-consumer scenarios. Multiple worker threads can concurrently call `handle_event()` to enqueue alert messages using the thread-safe `try_push()` operation. A dedicated output worker thread consumes messages from the queue using `pop()` and sends them to all configured outputs (stdout, file, syslog, gRPC, HTTP, etc.). This design is already proven in production, as Falco's multi-source support (where different event sources run in separate threads) already uses this same queue concurrently. The existing implementation requires no changes to support multi-threaded event processing. Note that while outputs are processed in order within the queue, alerts from different worker threads may be interleaved, meaning strict temporal ordering of alerts across different processes is not guaranteed. This is acceptable for security monitoring use cases where the primary concern is detecting and reporting security events rather than maintaining precise event ordering.
-
-### Work Partitioning Strategies
-
-A crucial and challenging design aspect is partitioning the work to achieve a good trade-off among the following properties:
-
-1. **Even load balancing** between threads
-2. **Low contention** on shared data (or no shared data)
-3. **Avoiding temporal inconsistencies and causality violations** (e.g., processing a file-opening event before the related process-forking event)
-
-The first two properties are primarily focused on performance, while the third is essential for the correctness of the solution. These aspects are intrinsically linked.
-
-Based on the analysis below, **Static Partitioning by TGID** is the proposed approach for the initial implementation.
-
-#### Static Partitioning by TGID (Thread Group ID / Process ID)
-
-Events are routed based on the TGID in kernel space (within the eBPF program) to a ring buffer dedicated to a specific partition. The routing logic executes at the point where events are captured, before they are written to any ring buffer. This partition is then consumed by a dedicated worker thread in userspace. The routing in the eBPF program can be accomplished with a simple hash and modulo operation, depending on the desired number of worker threads:
-
-```
-ring_buffer_index = hash(event->tgid) % num_workers
-```
-
-The hash function and number of workers are configured at eBPF program initialization time, allowing the kernel to route events directly to the appropriate ring buffer without userspace intervention.
-
-**Pros:**
-
-* **Reduced need for thread synchronization**: While structures keeping thread group data are shared across all worker threads and require synchronization, TGID partitioning minimizes cross-partition access. For data stored per thread-group (such as file descriptors), TGID partitioning guarantees a single writer (the worker thread assigned to that TGID), resulting in low contention since the data is mostly accessed by the same partition. Synchronization is needed only in two specific cases:
-  1. **Clone/fork events**: When handling clone/fork events, the worker thread needs to access thread information from the parent thread, which may reside in a different partition. This requires synchronization to read the parent's state (e.g., file descriptors, environment variables) that will be inherited by the child.
-  2. **Proc exit events**: When a process exits, reparenting logic may need to access thread information from other partitions to handle child processes that are being reparented to a different thread group.
-* Guarantee of sequential order processing of events related to the same thread group/process, as they are handled by the same worker thread. This limits the chance of temporal inconsistencies.
-
-**Cons:**
-
-* **Load Imbalance / "Hot" Process Vulnerability**: This static partitioning is susceptible to uneven worker load distribution, as a small number of high-activity ("hot") processes can overload the specific worker thread assigned to their TGID, creating a bottleneck.
-* **Cross-Partition Temporal Inconsistency**: Events that require information from a parent thread (e.g., fork/clone events) can still lead to causality issues. If the parent's related event is handled by a different, lagging partition, the required context might be incomplete or arrive out of order. Note that load imbalance amplifies this issue. Missing thread information is easy to detect, but there are also cases where information is present but not up-to-date or ahead of the time the clone event happened.
-
-  **Ancestor information during rule evaluation**: When evaluating rules that require ancestor information, the worker thread may need to access thread data from other partitions. Falco rules commonly check ancestor process attributes using fields that traverse the process hierarchy. Based on actual usage in Falco rules, commonly used ancestor fields include:
-  
-  - `proc.aname` / `proc.aname[N]` - ancestor process name (where N is the generation level: 1=parent, 2=grandparent, 3=great-grandparent, etc., up to at least level 7)
-  - `proc.aexepath[N]` - ancestor executable path (e.g., `proc.aexepath[2]` for grandparent)
-  - `proc.aexe[N]` - ancestor executable (e.g., `proc.aexe[2]` for grandparent)
-  
-  Accessing stale or "ahead" ancestor data (where the ancestor's state may be out of date or from events processed by other partitions with different timestamps) could lead to false positives or false negatives in rule evaluation. We acknowledge this potential issue and plan to assess its impact and determine appropriate mitigations once we have a running prototype.
-
-**Mitigations:**
-
-* **Last-Resort Fetching**: Fetching the thread information from a different channel to resolve the drift (e.g., proc scan, eBPF iterator). This solution is considered as a last resort because it risks slowing down the event processing loop, potentially negating the performance benefits of multi-threading.
-
-* **Context Synchronization**: Wait for the required thread information to become available. This can be decomposed into two orthogonal concerns:
-
-  **How to handle the wait:**
-
-  * **Wait/Sleep (Blocking)**: The worker thread blocks (sleeping or spinning) until the required data becomes available. Simple to implement, but the worker is idle during the wait, reducing throughput.
-  * **Deferring (Non-blocking)**: The event is copied/buffered for later processing; the worker continues with other events from its ring buffer. More complex (requires event copying, a pending queue, and a retry mechanism), but keeps the worker productive.
-
-  **How to detect data readiness:**
-
-  * **Polling**: Periodically check if the required data is available (spin-check for Wait/Sleep, or periodic retry for Deferring). Simple but wastes CPU cycles.
-  * **Signaling**: Partitions proactively notify each other when data is ready. More efficient but requires coordination infrastructure (e.g., condition variables, eventfd, or message queues).
-
-  These combine into four possible approaches:
-
-  | | Polling | Signaling |
-  |---|---------|-----------|
-  | **Wait/Sleep** | Spin-check until ready | Sleep on condition variable, wake on signal |
-  | **Deferring** | Periodically retry deferred events | Process deferred events when signaled |
-
-  **Synchronization point**: A natural synchronization point is the **clone exit parent event**. At this point, the parent process has completed setting up the child's initial state (inherited file descriptors, environment, etc.), making it safe to start processing events for the newly created thread group.
-
-  **Special case — `vfork()` / `CLONE_VFORK`**: When `vfork()` is used, the parent thread is blocked until the child calls `exec()` or exits, delaying the clone exit parent event. An alternative synchronization point may be needed (e.g., adding back clone enter parent).
-
-### Other Considered Approaches
-
-#### Static Partitioning by TID (Thread ID)
-
-Similar to the previous approach, but events are routed by TID instead of TGID.
-
-**Pros:**
-
-* Guarantee of sequential order processing of events related to the same thread, as they are handled by the same worker thread. This limits the chance of temporal inconsistencies.
-* Good enough load balancing between partitions.
-
-**Cons:**
-
-* **Cross-Partition Temporal Inconsistency**: This approach can lead to temporal inconsistencies when accessing/writing information from/to other processes or from the Thread Group Leader (e.g., environment, file descriptor information is stored in the thread group leader).
-
-#### Static Partitioning by CPU Core
-
-This approach routes events based on the CPU core where the event was captured. Each CPU core has its own ring buffer (per-CPU buffers), and multiple CPU buffers are assigned to the same partition. Each partition is consumed by a dedicated worker thread that reads from all the per-CPU buffers assigned to it. The number of partitions does not necessarily match the number of CPU cores—a single partition can read from multiple per-CPU buffers, allowing flexibility in choosing the number of worker threads independently from the number of CPU cores. This leverages the existing per-CPU ring buffer infrastructure used by the kernel module (kmod) and legacy eBPF probe, where events are written to per-CPU buffers that are then grouped into partitions consumed by worker threads.
-
-**Pros:**
-
-* **Natural Load Distribution**: Events are naturally distributed across CPUs based on where processes execute, providing inherent load balancing that reflects actual system activity.
-* **No Routing Logic Required**: Uses the existing per-CPU ring buffer design, eliminating the need for custom routing logic in kernel or userspace. CPU cores are simply mapped to partitions (e.g., via modulo operation: `partition = cpu_id % num_workers`), and each worker thread reads from all per-CPU buffers assigned to its partition.
-* **Low Synchronization Overhead**: Events from per-CPU buffers assigned to the same partition are processed sequentially by the same worker thread, reducing cross-thread synchronization needs.
-* **Flexible Partitioning**: The number of partitions (and thus worker threads) can be chosen independently from the number of CPU cores, allowing optimization based on workload characteristics rather than hardware topology.
-
-**Cons:**
-
-* **Cross-CPU Temporal Inconsistency**: Events from the same process or thread group can be processed by different worker threads if the process migrates between CPUs, leading to potential temporal inconsistencies and causality violations. This is particularly problematic for multi-threaded applications that may execute on different CPUs.
-* **Process Migration Effects**: CPU migration can cause events from the same process to be processed out of order, as events captured on different CPUs are handled by different worker threads.
-* **Load Imbalance with CPU Grouping**: When multiple per-CPU buffers are assigned to the same partition, the worker thread must process events from all assigned buffers. If the activity levels across these CPUs are uneven, the worker thread may experience load imbalance, with some partitions handling more active CPUs than others. The worker thread must also coordinate reading from multiple buffers, potentially using techniques similar to the current `O(n_cpus)` scan to maintain event ordering.
-* **Modern eBPF Probe Limitation**: The modern eBPF probe uses `BPF_MAP_TYPE_RINGBUF`, which does not have a per-CPU design. This approach would only be viable with the kernel module (kmod) or legacy eBPF probe that use `BPF_MAP_TYPE_PERF_EVENT_ARRAY` with per-CPU buffers.
-
-#### Functional Partitioning (Pipelining)
-
-Instead of partitioning the data, this approach partitions the work by splitting processing into phases:
-
-1. **Parsing**: Runs in a single thread, the state is updated in this phase.
-2. **Rules evaluation**: Runs in a thread chosen from a worker thread pool, the state is accessed but not modified.
-
-**Pros:**
-
-* The state handling remains single-threaded, avoiding any synchronization issue on the write side.
-* The load balancing of the Rules evaluation phase is good as it does not require any form of stickiness. Every worker can take whatever event, and a simple round-robin policy can be applied.
-
-**Cons:**
-
-* The "Parsing" stage is likely to become the bottleneck; a single thread here limits total throughput regardless of how many cores you have.
-* As we are parallelizing parsing and rules evaluation phases, we need an MVCC (multi-version concurrency control) technique to maintain multiple levels of state to use the state at the right point in time during rules evaluation.
-* Processing multiple events in parallel involves changes at the driver and libscap level. At the moment we are processing one event at a time from the driver memory without copying. To be able to process multiple events in parallel, we need to adapt the ring-buffer to make sure that `next()` does not consume the event. We would also need some flow control (e.g., backpressure) to avoid processing too many events in parallel. This problem would arise only if the rules evaluation phase is slower than the parsing phase.
-
-#### Comparison Summary
-
-| Approach | Load Balancing | Contention | Temporal Consistency |
-|----------|----------------|------------|----------------------|
-| TGID | Moderate (hot process risk) | Low | Good (within process) |
-| TID | Good | Higher | Partial (thread-level only) |
-| CPU Core | Good | Low | Poor (process migration issues) |
-| Pipelining | Good (rules evaluation phase) | Low (writes) | Requires MVCC |
-
-#### Rationale for TGID Partitioning
-
-TGID partitioning was chosen because it offers the best balance between synchronization complexity and correctness guarantees. TID partitioning increases cross-partition access for thread group leader data (e.g., file descriptor table, working directory, environment variables), increasing the coordination cost. Per-CPU partitioning, while leveraging existing infrastructure, suffers from process migration issues that can cause significant temporal inconsistencies when processes move between CPUs. Functional partitioning, while elegant in its separation of concerns, introduces a single-threaded bottleneck in the parsing phase that limits scalability regardless of available cores, and requires complex MVCC mechanisms for data consistency and mechanisms for handling multiple events in parallel.
-
-### Risks and Mitigations
-
-- **Increased Complexity**: Multi-threading introduces complexity in terms of synchronization and state management. Mitigation: Careful design of shared state and synchronization mechanisms, along with thorough testing.
-- **Synchronization Overhead vs Performance Gains**: The overhead of synchronization might negate the performance benefits of multi-threading. Mitigation: Use lightweight synchronization techniques and minimize shared state access.
-- **Synchronization Overhead vs Data Consistency**: In order to keep the synchronization overhead low with the shared state, we might need to relax some data consistency guarantees. Mitigation: Analyze the trade-offs and ensure that any relaxed guarantees do not compromise security.

unit_tests/engine/test_rule_loader.cpp

@@ -1516,3 +1516,282 @@ TEST_F(test_falco_engine, no_deprecated_field_warning_in_output) {
 	ASSERT_FALSE(check_warning_message("evt.dir")) << m_load_result_string;
 	EXPECT_EQ(num_rules_for_ruleset(), 1);
 }
+
+// Capture field tests
+
+TEST_F(test_falco_engine, rule_capture_enabled) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule
+  condition: evt.type = close
+  output: user=%user.name
+  priority: WARNING
+  capture: true
+)END";
+
+	std::string rule_name = "test_rule";
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+
+	auto rule_description = m_engine->describe_rule(&rule_name, {});
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture"].template get<bool>(), true);
+}
+
+TEST_F(test_falco_engine, rule_capture_disabled_by_default) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule
+  condition: evt.type = close
+  output: user=%user.name
+  priority: INFO
+)END";
+
+	std::string rule_name = "test_rule";
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+
+	auto rule_description = m_engine->describe_rule(&rule_name, {});
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture"].template get<bool>(), false);
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture_duration"].template get<uint32_t>(),
+	          0u);
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture_events"].template get<uint32_t>(), 0u);
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture_filesize"].template get<uint32_t>(),
+	          0u);
+}
+
+TEST_F(test_falco_engine, rule_capture_duration) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule
+  condition: evt.type = close
+  output: user=%user.name
+  priority: WARNING
+  capture: true
+  capture_duration: 10000
+)END";
+
+	std::string rule_name = "test_rule";
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+
+	auto rule_description = m_engine->describe_rule(&rule_name, {});
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture_duration"].template get<uint32_t>(),
+	          10000u);
+}
+
+TEST_F(test_falco_engine, rule_capture_events) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule
+  condition: evt.type = close
+  output: user=%user.name
+  priority: WARNING
+  capture: true
+  capture_events: 25000
+)END";
+
+	std::string rule_name = "test_rule";
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+
+	auto rule_description = m_engine->describe_rule(&rule_name, {});
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture_events"].template get<uint32_t>(),
+	          25000u);
+}
+
+TEST_F(test_falco_engine, rule_capture_filesize) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule
+  condition: evt.type = close
+  output: user=%user.name
+  priority: WARNING
+  capture: true
+  capture_filesize: 80000
+)END";
+
+	std::string rule_name = "test_rule";
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+
+	auto rule_description = m_engine->describe_rule(&rule_name, {});
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture_filesize"].template get<uint32_t>(),
+	          80000u);
+}
+
+TEST_F(test_falco_engine, rule_capture_all_fields) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule
+  condition: evt.type = close
+  output: user=%user.name
+  priority: WARNING
+  capture: true
+  capture_duration: 5000
+  capture_events: 10000
+  capture_filesize: 2048
+)END";
+
+	std::string rule_name = "test_rule";
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+
+	auto rule_description = m_engine->describe_rule(&rule_name, {});
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture"].template get<bool>(), true);
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture_duration"].template get<uint32_t>(),
+	          5000u);
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture_events"].template get<uint32_t>(),
+	          10000u);
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture_filesize"].template get<uint32_t>(),
+	          2048u);
+}
+
+TEST_F(test_falco_engine, rule_override_capture_replace) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule
+  condition: evt.type = close
+  output: user=%user.name
+  priority: WARNING
+  capture: true
+
+- rule: test_rule
+  capture: false
+  override:
+    capture: replace
+)END";
+
+	std::string rule_name = "test_rule";
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+
+	auto rule_description = m_engine->describe_rule(&rule_name, {});
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture"].template get<bool>(), false);
+}
+
+TEST_F(test_falco_engine, rule_override_capture_duration_replace) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule
+  condition: evt.type = close
+  output: user=%user.name
+  priority: WARNING
+  capture: true
+  capture_duration: 5000
+
+- rule: test_rule
+  capture_duration: 15000
+  override:
+    capture_duration: replace
+)END";
+
+	std::string rule_name = "test_rule";
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+
+	auto rule_description = m_engine->describe_rule(&rule_name, {});
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture_duration"].template get<uint32_t>(),
+	          15000u);
+}
+
+TEST_F(test_falco_engine, rule_override_capture_events_replace) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule
+  condition: evt.type = close
+  output: user=%user.name
+  priority: WARNING
+  capture_events: 1000
+
+- rule: test_rule
+  capture_events: 5000
+  override:
+    capture_events: replace
+)END";
+
+	std::string rule_name = "test_rule";
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+
+	auto rule_description = m_engine->describe_rule(&rule_name, {});
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture_events"].template get<uint32_t>(),
+	          5000u);
+}
+
+TEST_F(test_falco_engine, rule_override_capture_filesize_replace) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule
+  condition: evt.type = close
+  output: user=%user.name
+  priority: WARNING
+  capture_filesize: 1024
+
+- rule: test_rule
+  capture_filesize: 4096
+  override:
+    capture_filesize: replace
+)END";
+
+	std::string rule_name = "test_rule";
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml")) << m_load_result_string;
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_ok) << m_load_result->schema_validation();
+
+	auto rule_description = m_engine->describe_rule(&rule_name, {});
+	ASSERT_EQ(rule_description["rules"][0]["info"]["capture_filesize"].template get<uint32_t>(),
+	          4096u);
+}
+
+TEST_F(test_falco_engine, rule_capture_events_wrong_type) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule
+  condition: evt.type = close
+  output: user=%user.name
+  priority: INFO
+  capture_events: "not_a_number"
+)END";
+
+	// String value for an integer field causes a load error
+	ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
+}
+
+TEST_F(test_falco_engine, rule_capture_filesize_wrong_type) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule
+  condition: evt.type = close
+  output: user=%user.name
+  priority: INFO
+  capture_filesize: "not_a_number"
+)END";
+
+	ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
+}
+
+TEST_F(test_falco_engine, rule_capture_duration_wrong_type) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule
+  condition: evt.type = close
+  output: user=%user.name
+  priority: INFO
+  capture_duration: "not_a_number"
+)END";
+
+	ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
+}
+
+TEST_F(test_falco_engine, rule_capture_wrong_type) {
+	std::string rules_content = R"END(
+- rule: test_rule
+  desc: test rule
+  condition: evt.type = close
+  output: user=%user.name
+  priority: INFO
+  capture: "yes"
+)END";
+
+	ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
+	ASSERT_VALIDATION_STATUS(yaml_helper::validation_failed) << m_load_result->schema_validation();
+}

unit_tests/falco/test_capture.cpp

@@ -79,6 +79,8 @@ plugins:
 	EXPECT_EQ(config.m_capture_path_prefix, "/tmp/falco");
 	EXPECT_EQ(config.m_capture_mode, capture_mode_t::RULES);
 	EXPECT_EQ(config.m_capture_default_duration_ns, 5000 * 1000000LL);  // 5 seconds in ns
+	EXPECT_EQ(config.m_capture_default_events, 0u);
+	EXPECT_EQ(config.m_capture_default_filesize_kb, 0u);
 }
 
 TEST(Capture, capture_config_enabled_rules_mode) {
@@ -132,3 +134,51 @@ capture:
 	// Should throw an exception for invalid mode
 	EXPECT_THROW(res = config.init_from_content(config_content, {}), std::logic_error);
 }
+
+TEST(Capture, capture_config_with_events_limit) {
+	std::string config_content = R"(
+capture:
+  enabled: true
+  default_events: 50000
+)";
+
+	falco_configuration config;
+	config_loaded_res res;
+	ASSERT_NO_THROW(res = config.init_from_content(config_content, {}));
+
+	EXPECT_EQ(config.m_capture_default_events, 50000u);
+	EXPECT_EQ(config.m_capture_default_filesize_kb, 0u);
+}
+
+TEST(Capture, capture_config_with_filesize_limit) {
+	std::string config_content = R"(
+capture:
+  enabled: true
+  default_filesize: 10240
+)";
+
+	falco_configuration config;
+	config_loaded_res res;
+	ASSERT_NO_THROW(res = config.init_from_content(config_content, {}));
+
+	EXPECT_EQ(config.m_capture_default_events, 0u);
+	EXPECT_EQ(config.m_capture_default_filesize_kb, 10240u);
+}
+
+TEST(Capture, capture_config_with_all_limits) {
+	std::string config_content = R"(
+capture:
+  enabled: true
+  default_duration: 15000
+  default_events: 25000
+  default_filesize: 80000
+)";
+
+	falco_configuration config;
+	config_loaded_res res;
+	ASSERT_NO_THROW(res = config.init_from_content(config_content, {}));
+
+	EXPECT_EQ(config.m_capture_default_duration_ns, 15000 * 1000000LL);
+	EXPECT_EQ(config.m_capture_default_events, 25000u);
+	EXPECT_EQ(config.m_capture_default_filesize_kb, 80000u);
+}

userspace/engine/CMakeLists.txt

@@ -21,7 +21,6 @@ add_library(
 	filter_ruleset.cpp
 	evttype_index_ruleset.cpp
 	formats.cpp
-	field_formatter.cpp
 	filter_details_resolver.cpp
 	filter_macro_resolver.cpp
 	filter_warning_resolver.cpp

userspace/engine/falco_engine.cpp

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /*
-Copyright (C) 2025 The Falco Authors.
+Copyright (C) 2026 The Falco Authors.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -42,7 +42,6 @@ limitations under the License.
 #include "falco_engine_version.h"
 
 #include "formats.h"
-#include "field_formatter.h"
 
 #include "evttype_index_ruleset.h"
 
@@ -118,7 +117,7 @@ static std::string fieldclass_key(const sinsp_filter_factory::filter_fieldclass_
 void falco_engine::list_fields(const std::string &source,
                                bool verbose,
                                bool names_only,
-                               output_format format) const {
+                               bool markdown) const {
 	// Maps from field class name + short desc to list of event
 	// sources for which this field class can be used.
 	std::map<std::string, std::set<std::string>> fieldclass_event_sources;
@@ -139,10 +138,6 @@ void falco_engine::list_fields(const std::string &source,
 	// printing field classes multiple times for different sources
 	std::set<std::string> seen_fieldclasses;
 
-	// Create the appropriate formatter and use it
-	auto formatter = FieldFormatter::create(format, verbose);
-	formatter->begin();
-
 	// In the second pass, actually print info, skipping duplicate
 	// field classes and also printing info on supported sources.
 	for(const auto &it : m_sources) {
@@ -165,15 +160,21 @@ void falco_engine::list_fields(const std::string &source,
 						continue;
 					}
 
-					formatter->print_field_name(field.name);
+					printf("%s\n", field.name.c_str());
 				}
+			} else if(markdown) {
+				printf("%s\n",
+				       fld_class.as_markdown(fieldclass_event_sources[fieldclass_key(fld_class)])
+				               .c_str());
 			} else {
-				formatter->print_fieldclass(fld_class, fieldclass_event_sources[key]);
+				printf("%s\n",
+				       fld_class
+				               .as_string(verbose,
+				                          fieldclass_event_sources[fieldclass_key(fld_class)])
+				               .c_str());
 			}
 		}
 	}
-
-	formatter->end();
 }
 
 std::unique_ptr<load_result> falco_engine::load_rules(const std::string &rules_content,
@@ -414,6 +415,8 @@ std::unique_ptr<std::vector<falco_engine::rule_result>> falco_engine::process_ev
 		rule_result.priority_num = rule.priority;
 		rule_result.capture = rule.capture;
 		rule_result.capture_duration_ns = uint64_t(rule.capture_duration) * 1000000LL;
+		rule_result.capture_events = uint64_t(rule.capture_events);
+		rule_result.capture_filesize_kb = uint64_t(rule.capture_filesize);
 		rule_result.tags = rule.tags;
 		rule_result.exception_fields = rule.exception_fields;
 		rule_result.extra_output_fields = rule.extra_output_fields;
@@ -571,6 +574,8 @@ void falco_engine::get_json_details(
 	rule_info["source"] = r.source;
 	rule_info["capture"] = r.capture;
 	rule_info["capture_duration"] = r.capture_duration;
+	rule_info["capture_events"] = r.capture_events;
+	rule_info["capture_filesize"] = r.capture_filesize;
 	rule_info["tags"] = sequence_to_json_array(info.tags);
 	out["info"] = std::move(rule_info);
 

userspace/engine/falco_engine.h

@@ -34,7 +34,6 @@ limitations under the License.
 #include "falco_source.h"
 #include "falco_load_result.h"
 #include "filter_details_resolver.h"
-#include "output_format.h"
 
 //
 // This class acts as the primary interface between a program and the
@@ -63,10 +62,7 @@ public:
 
 	// Print to stdout (using printf) a description of each field supported by this engine.
 	// If source is non-empty, only fields for the provided source are printed.
-	void list_fields(const std::string &source,
-	                 bool verbose,
-	                 bool names_only,
-	                 output_format format) const;
+	void list_fields(const std::string &source, bool verbose, bool names_only, bool markdown) const;
 
 	// Provide an alternate rule reader, collector, and compiler
 	// to compile any rules provided via load_rules*
@@ -233,6 +229,8 @@ public:
 		extra_output_field_t extra_output_fields;
 		bool capture;
 		uint64_t capture_duration_ns;
+		uint64_t capture_events;
+		uint64_t capture_filesize_kb;
 	};
 
 	//

userspace/engine/falco_engine_version.h

@@ -20,7 +20,7 @@ limitations under the License.
 
 // The version of this Falco engine
 #define FALCO_ENGINE_VERSION_MAJOR 0
-#define FALCO_ENGINE_VERSION_MINOR 60
+#define FALCO_ENGINE_VERSION_MINOR 61
 #define FALCO_ENGINE_VERSION_PATCH 0
 
 #define FALCO_ENGINE_VERSION                                                               \

userspace/engine/falco_rule.h

@@ -81,7 +81,9 @@ struct falco_rule {
 	        id(0),
 	        priority(falco_common::PRIORITY_DEBUG),
 	        capture(false),
-	        capture_duration(0) {}
+	        capture_duration(0),
+	        capture_events(0),
+	        capture_filesize(0) {}
 	falco_rule(falco_rule&&) = default;
 	falco_rule& operator=(falco_rule&&) = default;
 	falco_rule(const falco_rule&) = default;
@@ -112,6 +114,8 @@ struct falco_rule {
 	falco_common::priority_type priority;
 	bool capture;
 	uint32_t capture_duration;
+	uint32_t capture_events;
+	uint32_t capture_filesize;
 	std::shared_ptr<libsinsp::filter::ast::expr> condition;
 	std::shared_ptr<sinsp_filter> filter;
 };

userspace/engine/field_formatter.cpp

@@ -1,122 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-/*
-Copyright (C) 2026 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include "field_formatter.h"
-#include "formats.h"
-
-using namespace falco;
-
-// Factory method
-std::unique_ptr<FieldFormatter> FieldFormatter::create(output_format format, bool verbose) {
-	switch(format) {
-	case output_format::JSON:
-		return std::make_unique<JsonFieldFormatter>(verbose);
-	case output_format::MARKDOWN:
-		return std::make_unique<MarkdownFieldFormatter>(verbose);
-	case output_format::TEXT:
-	default:
-		return std::make_unique<TextFieldFormatter>(verbose);
-	}
-}
-
-// ============================================================================
-// TextFieldFormatter implementation
-// ============================================================================
-
-TextFieldFormatter::TextFieldFormatter(bool verbose): m_verbose(verbose) {}
-
-void TextFieldFormatter::begin() {
-	// Nothing to do for text format
-}
-
-void TextFieldFormatter::print_fieldclass(
-        const sinsp_filter_factory::filter_fieldclass_info& fld_class,
-        const std::set<std::string>& event_sources) {
-	printf("%s\n", fld_class.as_string(m_verbose, event_sources).c_str());
-}
-
-void TextFieldFormatter::print_field_name(const std::string& name) {
-	printf("%s\n", name.c_str());
-}
-
-void TextFieldFormatter::end() {
-	// Nothing to do for text format
-}
-
-// ============================================================================
-// MarkdownFieldFormatter implementation
-// ============================================================================
-
-MarkdownFieldFormatter::MarkdownFieldFormatter(bool verbose): m_verbose(verbose) {}
-
-void MarkdownFieldFormatter::begin() {
-	// Nothing to do for markdown format
-}
-
-void MarkdownFieldFormatter::print_fieldclass(
-        const sinsp_filter_factory::filter_fieldclass_info& fld_class,
-        const std::set<std::string>& event_sources) {
-	printf("%s\n", fld_class.as_markdown(event_sources).c_str());
-}
-
-void MarkdownFieldFormatter::print_field_name(const std::string& name) {
-	printf("%s\n", name.c_str());
-}
-
-void MarkdownFieldFormatter::end() {
-	// Nothing to do for markdown format
-}
-
-// ============================================================================
-// JsonFieldFormatter implementation
-// ============================================================================
-
-JsonFieldFormatter::JsonFieldFormatter(bool verbose): m_verbose(verbose) {}
-
-void JsonFieldFormatter::begin() {
-	m_fieldclasses_array = nlohmann::json::array();
-	m_fieldnames_array = nlohmann::json::array();
-	m_has_fieldclasses = false;
-	m_has_fieldnames = false;
-}
-
-void JsonFieldFormatter::print_fieldclass(
-        const sinsp_filter_factory::filter_fieldclass_info& fld_class,
-        const std::set<std::string>& event_sources) {
-	std::string json_str = fld_class.as_json(event_sources);
-	if(!json_str.empty()) {
-		m_fieldclasses_array.push_back(nlohmann::json::parse(json_str));
-		m_has_fieldclasses = true;
-	}
-}
-
-void JsonFieldFormatter::print_field_name(const std::string& name) {
-	m_fieldnames_array.push_back(name);
-	m_has_fieldnames = true;
-}
-
-void JsonFieldFormatter::end() {
-	nlohmann::json root;
-
-	if(m_has_fieldclasses) {
-		root["fieldclasses"] = m_fieldclasses_array;
-		printf("%s\n", root.dump(2).c_str());
-	} else if(m_has_fieldnames) {
-		root["fieldnames"] = m_fieldnames_array;
-		printf("%s\n", root.dump(2).c_str());
-	}
-}

userspace/engine/field_formatter.h

@@ -1,102 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-/*
-Copyright (C) 2026 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#pragma once
-
-#include <string>
-#include <set>
-#include <memory>
-#include <nlohmann/json.hpp>
-
-#include <libsinsp/sinsp.h>
-
-enum class output_format;
-
-namespace falco {
-
-// Abstract formatter interface for field listing
-class FieldFormatter {
-public:
-	virtual ~FieldFormatter() = default;
-
-	// Initialize formatter
-	virtual void begin() = 0;
-
-	// Print a field class with its event sources
-	virtual void print_fieldclass(const sinsp_filter_factory::filter_fieldclass_info& fld_class,
-	                              const std::set<std::string>& event_sources) = 0;
-
-	// Print a single field name (for names_only mode)
-	virtual void print_field_name(const std::string& name) = 0;
-
-	// Finalize and output
-	virtual void end() = 0;
-
-	// Factory method
-	static std::unique_ptr<FieldFormatter> create(output_format format, bool verbose);
-};
-
-// Text formatter (default)
-class TextFieldFormatter : public FieldFormatter {
-public:
-	explicit TextFieldFormatter(bool verbose);
-
-	void begin() override;
-	void print_fieldclass(const sinsp_filter_factory::filter_fieldclass_info& fld_class,
-	                      const std::set<std::string>& event_sources) override;
-	void print_field_name(const std::string& name) override;
-	void end() override;
-
-private:
-	bool m_verbose;
-};
-
-// Markdown formatter
-class MarkdownFieldFormatter : public FieldFormatter {
-public:
-	explicit MarkdownFieldFormatter(bool verbose);
-
-	void begin() override;
-	void print_fieldclass(const sinsp_filter_factory::filter_fieldclass_info& fld_class,
-	                      const std::set<std::string>& event_sources) override;
-	void print_field_name(const std::string& name) override;
-	void end() override;
-
-private:
-	bool m_verbose;
-};
-
-// JSON formatter
-class JsonFieldFormatter : public FieldFormatter {
-public:
-	explicit JsonFieldFormatter(bool verbose);
-
-	void begin() override;
-	void print_fieldclass(const sinsp_filter_factory::filter_fieldclass_info& fld_class,
-	                      const std::set<std::string>& event_sources) override;
-	void print_field_name(const std::string& name) override;
-	void end() override;
-
-private:
-	bool m_verbose;
-	nlohmann::json m_fieldclasses_array;
-	nlohmann::json m_fieldnames_array;
-	bool m_has_fieldclasses{false};
-	bool m_has_fieldnames{false};
-};
-
-}  // namespace falco

userspace/engine/output_format.h

@@ -1,20 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-/*
-Copyright (C) 2026 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#pragma once
-
-enum class output_format { TEXT, MARKDOWN, JSON };

userspace/engine/rule_json_schema.h

@@ -80,6 +80,12 @@ const char rule_schema_string[] = LONG_STRING_CONST(
                 "capture_duration": {
                     "type": "integer"
                 },
+                "capture_events": {
+                    "type": "integer"
+                },
+                "capture_filesize": {
+                    "type": "integer"
+                },
                 "source": {
 	                "type": "string"
                 },
@@ -189,6 +195,12 @@ const char rule_schema_string[] = LONG_STRING_CONST(
                 "capture_duration": {
                     "$ref": "#/definitions/OverriddenItem"
                 },
+                "capture_events": {
+                    "$ref": "#/definitions/OverriddenItem"
+                },
+                "capture_filesize": {
+                    "$ref": "#/definitions/OverriddenItem"
+                },
                 "tags": {
                     "$ref": "#/definitions/OverriddenItem"
                 },

userspace/engine/rule_loader.h

@@ -503,6 +503,8 @@ struct rule_info {
 	falco_common::priority_type priority;
 	bool capture;
 	uint32_t capture_duration;
+	uint32_t capture_events;
+	uint32_t capture_filesize;
 	bool enabled;
 	bool warn_evttypes;
 	bool skip_if_unknown_filter;
@@ -523,7 +525,8 @@ struct rule_update_info {
 	bool has_any_value() {
 		return cond.has_value() || output.has_value() || desc.has_value() || tags.has_value() ||
 		       exceptions.has_value() || priority.has_value() || enabled.has_value() ||
-		       capture.has_value() || capture_duration.has_value() || warn_evttypes.has_value() ||
+		       capture.has_value() || capture_duration.has_value() || capture_events.has_value() ||
+		       capture_filesize.has_value() || warn_evttypes.has_value() ||
 		       skip_if_unknown_filter.has_value();
 	}
 
@@ -539,6 +542,8 @@ struct rule_update_info {
 	std::optional<falco_common::priority_type> priority;
 	std::optional<bool> capture;
 	std::optional<uint32_t> capture_duration;
+	std::optional<uint32_t> capture_events;
+	std::optional<uint32_t> capture_filesize;
 	std::optional<bool> enabled;
 	std::optional<bool> warn_evttypes;
 	std::optional<bool> skip_if_unknown_filter;

userspace/engine/rule_loader_collector.cpp

@@ -321,6 +321,14 @@ void rule_loader::collector::selective_replace(configuration& cfg, rule_update_i
 		prev->capture_duration = *info.capture_duration;
 	}
 
+	if(info.capture_events.has_value()) {
+		prev->capture_events = *info.capture_events;
+	}
+
+	if(info.capture_filesize.has_value()) {
+		prev->capture_filesize = *info.capture_filesize;
+	}
+
 	if(info.enabled.has_value()) {
 		prev->enabled = *info.enabled;
 	}

userspace/engine/rule_loader_compiler.cpp

@@ -544,6 +544,8 @@ void rule_loader::compiler::compile_rule_infos(const configuration& cfg,
 		rule.priority = r.priority;
 		rule.capture = r.capture;
 		rule.capture_duration = r.capture_duration;
+		rule.capture_events = r.capture_events;
+		rule.capture_filesize = r.capture_filesize;
 		rule.tags = r.tags;
 		auto rule_id = out.insert(rule, rule.name);
 		out.at(rule_id)->id = rule_id;

userspace/engine/rule_loader_reader.cpp

@@ -683,6 +683,8 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 		                                          "priority",
 		                                          "capture",
 		                                          "capture_duration",
+		                                          "capture_events",
+		                                          "capture_filesize",
 		                                          "tags",
 		                                          "exceptions",
 		                                          "enabled",
@@ -821,6 +823,22 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 					decode_val(item, "capture_duration", v.capture_duration, ctx);
 				}
 
+				if(check_update_expected(expected_keys,
+				                         override_replace,
+				                         "replace",
+				                         "capture_events",
+				                         ctx)) {
+					decode_val(item, "capture_events", v.capture_events, ctx);
+				}
+
+				if(check_update_expected(expected_keys,
+				                         override_replace,
+				                         "replace",
+				                         "capture_filesize",
+				                         ctx)) {
+					decode_val(item, "capture_filesize", v.capture_filesize, ctx);
+				}
+
 				if(check_update_expected(expected_keys,
 				                         override_replace,
 				                         "replace",
@@ -885,6 +903,8 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 			v.enabled = true;
 			v.capture = false;
 			v.capture_duration = 0;
+			v.capture_events = 0;
+			v.capture_filesize = 0;
 			v.warn_evttypes = true;
 			v.skip_if_unknown_filter = false;
 
@@ -932,6 +952,8 @@ void rule_loader::reader::read_item(rule_loader::configuration& cfg,
 				decode_optional_val(item, "enabled", v.enabled, ctx);
 				decode_optional_val(item, "capture", v.capture, ctx);
 				decode_optional_val(item, "capture_duration", v.capture_duration, ctx);
+				decode_optional_val(item, "capture_events", v.capture_events, ctx);
+				decode_optional_val(item, "capture_filesize", v.capture_filesize, ctx);
 				decode_optional_val(item, "warn_evttypes", v.warn_evttypes, ctx);
 				decode_optional_val(item, "skip-if-unknown-filter", v.skip_if_unknown_filter, ctx);
 				decode_tags(item, v.tags, ctx);

userspace/falco/CMakeLists.txt

@@ -40,7 +40,6 @@ add_library(
 	app/actions/print_plugin_info.cpp
 	app/actions/print_support.cpp
 	app/actions/print_syscall_events.cpp
-	app/actions/event_formatter.cpp
 	app/actions/print_version.cpp
 	app/actions/print_page_size.cpp
 	app/actions/configure_syscall_buffer_size.cpp

userspace/falco/app/actions/event_formatter.cpp

@@ -1,199 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-/*
-Copyright (C) 2026 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#include "event_formatter.h"
-
-#include <libsinsp/sinsp.h>
-#include <libsinsp/event.h>
-
-using namespace falco::app::actions;
-
-static bool is_flag_type(ppm_param_type type) {
-	return (type == PT_FLAGS8 || type == PT_FLAGS16 || type == PT_FLAGS32 ||
-	        type == PT_ENUMFLAGS8 || type == PT_ENUMFLAGS16 || type == PT_ENUMFLAGS32);
-}
-
-// Factory method
-std::unique_ptr<EventFormatter> EventFormatter::create(output_format format) {
-	switch(format) {
-	case output_format::JSON:
-		return std::make_unique<JsonFormatter>();
-	case output_format::MARKDOWN:
-		return std::make_unique<MarkdownFormatter>();
-	case output_format::TEXT:
-	default:
-		return std::make_unique<TextFormatter>();
-	}
-}
-
-// ============================================================================
-// TextFormatter implementation
-// ============================================================================
-
-void TextFormatter::begin(const std::string& schema_version) {
-	printf("The events below are valid for Falco *Schema Version*: %s\n", schema_version.c_str());
-}
-
-void TextFormatter::begin_category(const std::string& category) {
-	printf("## %s\n\n", category.c_str());
-}
-
-void TextFormatter::print_event(const event_entry& e) {
-	char dir = e.is_enter ? '>' : '<';
-	printf("%c %s(", dir, e.name.c_str());
-
-	for(uint32_t k = 0; k < e.info->nparams; k++) {
-		if(k != 0) {
-			printf(", ");
-		}
-		print_param(&e.info->params[k]);
-	}
-
-	printf(")\n");
-}
-
-void TextFormatter::end_category() {
-	printf("\n");
-}
-
-void TextFormatter::end() {
-	// Nothing to do for text format
-}
-
-void TextFormatter::print_param(const struct ppm_param_info* param) {
-	printf("%s **%s**", param_type_to_string(param->type), param->name);
-
-	if(is_flag_type(param->type) && param->info) {
-		auto flag_info = static_cast<const ppm_name_value*>(param->info);
-
-		printf(": ");
-		for(size_t i = 0; flag_info[i].name != NULL; i++) {
-			if(i != 0) {
-				printf(", ");
-			}
-			printf("%s", flag_info[i].name);
-		}
-	}
-}
-
-// ============================================================================
-// MarkdownFormatter implementation
-// ============================================================================
-
-void MarkdownFormatter::begin(const std::string& schema_version) {
-	printf("The events below are valid for Falco *Schema Version*: %s\n", schema_version.c_str());
-}
-
-void MarkdownFormatter::begin_category(const std::string& category) {
-	printf("## %s\n\n", category.c_str());
-	printf("Default | Dir | Name | Params \n");
-	printf(":-------|:----|:-----|:-----\n");
-}
-
-void MarkdownFormatter::print_event(const event_entry& e) {
-	char dir = e.is_enter ? '>' : '<';
-
-	printf(e.available ? "Yes" : "No");
-	printf(" | `%c` | `%s` | ", dir, e.name.c_str());
-
-	for(uint32_t k = 0; k < e.info->nparams; k++) {
-		if(k != 0) {
-			printf(", ");
-		}
-		print_param(&e.info->params[k]);
-	}
-
-	printf("\n");
-}
-
-void MarkdownFormatter::end_category() {
-	printf("\n");
-}
-
-void MarkdownFormatter::end() {
-	// Nothing to do for markdown format
-}
-
-void MarkdownFormatter::print_param(const struct ppm_param_info* param) {
-	printf("%s **%s**", param_type_to_string(param->type), param->name);
-
-	if(is_flag_type(param->type) && param->info) {
-		auto flag_info = static_cast<const ppm_name_value*>(param->info);
-
-		printf(": ");
-		for(size_t i = 0; flag_info[i].name != NULL; i++) {
-			if(i != 0) {
-				printf(", ");
-			}
-			printf("*%s*", flag_info[i].name);
-		}
-	}
-}
-
-// ============================================================================
-// JsonFormatter implementation
-// ============================================================================
-
-void JsonFormatter::begin(const std::string& schema_version) {
-	m_root = nlohmann::json::object();
-	m_root["schema_version"] = schema_version;
-}
-
-void JsonFormatter::begin_category(const std::string& category) {
-	m_current_category = nlohmann::json::array();
-	m_current_category_name = category;
-}
-
-void JsonFormatter::print_event(const event_entry& e) {
-	m_current_category.push_back(event_to_json(e));
-}
-
-void JsonFormatter::end_category() {
-	m_root[m_current_category_name] = m_current_category;
-}
-
-void JsonFormatter::end() {
-	printf("%s\n", m_root.dump(2).c_str());
-}
-
-nlohmann::json JsonFormatter::event_to_json(const event_entry& e) {
-	nlohmann::json event;
-	event["name"] = e.name;
-	event["dir"] = e.is_enter ? ">" : "<";
-	event["available"] = e.available;
-
-	nlohmann::json params = nlohmann::json::array();
-	for(uint32_t k = 0; k < e.info->nparams; k++) {
-		nlohmann::json param;
-		param["type"] = param_type_to_string(e.info->params[k].type);
-		param["name"] = e.info->params[k].name;
-
-		if(is_flag_type(e.info->params[k].type) && e.info->params[k].info) {
-			auto flag_info = static_cast<const ppm_name_value*>(e.info->params[k].info);
-			nlohmann::json flags = nlohmann::json::array();
-			for(size_t i = 0; flag_info[i].name != NULL; i++) {
-				flags.push_back(flag_info[i].name);
-			}
-			param["flags"] = flags;
-		}
-
-		params.push_back(param);
-	}
-	event["params"] = params;
-
-	return event;
-}

userspace/falco/app/actions/event_formatter.h

@@ -1,111 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-/*
-Copyright (C) 2026 The Falco Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-#pragma once
-
-#include <string>
-#include <vector>
-#include <cstdint>
-#include <memory>
-#include <nlohmann/json.hpp>
-
-#include "../../../engine/output_format.h"
-
-struct ppm_param_info;
-struct ppm_event_info;
-
-namespace falco {
-namespace app {
-namespace actions {
-
-struct event_entry {
-	bool is_enter;
-	bool available;
-	std::string name;
-	const ppm_event_info* info;
-};
-
-// Abstract formatter interface
-class EventFormatter {
-public:
-	virtual ~EventFormatter() = default;
-
-	// Initialize formatter with schema version
-	virtual void begin(const std::string& schema_version) = 0;
-
-	// Print category header
-	virtual void begin_category(const std::string& category) = 0;
-
-	// Print a single event
-	virtual void print_event(const event_entry& e) = 0;
-
-	// End category
-	virtual void end_category() = 0;
-
-	// Finalize and output
-	virtual void end() = 0;
-
-	// Factory method
-	static std::unique_ptr<EventFormatter> create(output_format format);
-};
-
-// Text formatter (default)
-class TextFormatter : public EventFormatter {
-public:
-	void begin(const std::string& schema_version) override;
-	void begin_category(const std::string& category) override;
-	void print_event(const event_entry& e) override;
-	void end_category() override;
-	void end() override;
-
-private:
-	void print_param(const struct ppm_param_info* param);
-};
-
-// Markdown formatter
-class MarkdownFormatter : public EventFormatter {
-public:
-	void begin(const std::string& schema_version) override;
-	void begin_category(const std::string& category) override;
-	void print_event(const event_entry& e) override;
-	void end_category() override;
-	void end() override;
-
-private:
-	void print_param(const struct ppm_param_info* param);
-};
-
-// JSON formatter
-class JsonFormatter : public EventFormatter {
-public:
-	void begin(const std::string& schema_version) override;
-	void begin_category(const std::string& category) override;
-	void print_event(const event_entry& e) override;
-	void end_category() override;
-	void end() override;
-
-private:
-	nlohmann::json m_root;
-	nlohmann::json m_current_category;
-	std::string m_current_category_name;
-
-	nlohmann::json event_to_json(const event_entry& e);
-};
-
-}  // namespace actions
-}  // namespace app
-}  // namespace falco

userspace/falco/app/actions/list_fields.cpp

@@ -33,6 +33,6 @@ falco::app::run_result falco::app::actions::list_fields(falco::app::state& s) {
 	s.engine->list_fields(s.options.list_source_fields,
 	                      s.options.verbose,
 	                      s.options.names_only,
-	                      s.options.output_fmt);
+	                      s.options.markdown);
 	return run_result::exit();
 }

userspace/falco/app/actions/print_syscall_events.cpp

@@ -17,13 +17,19 @@ limitations under the License.
 
 #include "actions.h"
 #include "helpers.h"
-#include "event_formatter.h"
 #include "../app.h"
 #include "../../versions_info.h"
 
 using namespace falco::app;
 using namespace falco::app::actions;
 
+struct event_entry {
+	bool is_enter;
+	bool available;
+	std::string name;
+	const ppm_event_info* info;
+};
+
 struct events_by_category {
 	std::vector<event_entry> syscalls;
 	std::vector<event_entry> tracepoints;
@@ -63,32 +69,6 @@ struct events_by_category {
 			return;
 		}
 	}
-
-	void print_all(EventFormatter& formatter) {
-		formatter.begin_category("Syscall events");
-		for(const auto& e : syscalls) {
-			formatter.print_event(e);
-		}
-		formatter.end_category();
-
-		formatter.begin_category("Tracepoint events");
-		for(const auto& e : tracepoints) {
-			formatter.print_event(e);
-		}
-		formatter.end_category();
-
-		formatter.begin_category("Plugin events");
-		for(const auto& e : pluginevents) {
-			formatter.print_event(e);
-		}
-		formatter.end_category();
-
-		formatter.begin_category("Metaevents");
-		for(const auto& e : metaevents) {
-			formatter.print_event(e);
-		}
-		formatter.end_category();
-	}
 };
 
 static struct events_by_category get_event_entries_by_category(
@@ -120,21 +100,86 @@ static struct events_by_category get_event_entries_by_category(
 	return result;
 }
 
+static bool is_flag_type(ppm_param_type type) {
+	return (type == PT_FLAGS8 || type == PT_FLAGS16 || type == PT_FLAGS32 ||
+	        type == PT_ENUMFLAGS8 || type == PT_ENUMFLAGS16 || type == PT_ENUMFLAGS32);
+}
+
+static void print_param(const struct ppm_param_info* param, bool markdown) {
+	printf("%s **%s**", param_type_to_string(param->type), param->name);
+
+	if(is_flag_type(param->type) && param->info) {
+		auto flag_info = static_cast<const ppm_name_value*>(param->info);
+
+		printf(": ");
+		for(size_t i = 0; flag_info[i].name != NULL; i++) {
+			if(i != 0) {
+				printf(", ");
+			}
+
+			if(markdown) {
+				printf("*%s*", flag_info[i].name);
+			} else {
+				printf("%s", flag_info[i].name);
+			}
+		}
+	}
+}
+
+static void print_events(const std::vector<event_entry>& events, bool markdown) {
+	if(markdown) {
+		printf("Default | Dir | Name | Params \n");
+		printf(":-------|:----|:-----|:-----\n");
+	}
+
+	for(const auto& e : events) {
+		char dir = e.is_enter ? '>' : '<';
+		if(markdown) {
+			printf(e.available ? "Yes" : "No");
+			printf(" | `%c` | `%s` | ", dir, e.name.c_str());
+		} else {
+			printf("%c %s(", dir, e.name.c_str());
+		}
+
+		for(uint32_t k = 0; k < e.info->nparams; k++) {
+			if(k != 0) {
+				printf(", ");
+			}
+
+			print_param(&e.info->params[k], markdown);
+		}
+		if(markdown) {
+			printf("\n");
+		} else {
+			printf(")\n");
+		}
+	}
+}
+
 falco::app::run_result falco::app::actions::print_syscall_events(falco::app::state& s) {
 	if(!s.options.list_syscall_events) {
 		return run_result::ok();
 	}
 
 	const falco::versions_info info(s.offline_inspector);
+	printf("The events below are valid for Falco *Schema Version*: %s\n",
+	       info.driver_schema_version.c_str());
+
 	const libsinsp::events::set<ppm_event_code> available = libsinsp::events::all_event_set().diff(
 	        sc_set_to_event_set(falco::app::ignored_sc_set()));
-	struct events_by_category events_bc = get_event_entries_by_category(true, available);
+	const struct events_by_category events_bc = get_event_entries_by_category(true, available);
 
-	// Create the appropriate formatter and use it
-	auto formatter = EventFormatter::create(s.options.output_fmt);
-	formatter->begin(info.driver_schema_version);
-	events_bc.print_all(*formatter);
-	formatter->end();
+	printf("## Syscall events\n\n");
+	print_events(events_bc.syscalls, s.options.markdown);
+
+	printf("\n\n## Tracepoint events\n\n");
+	print_events(events_bc.tracepoints, s.options.markdown);
+
+	printf("\n\n## Plugin events\n\n");
+	print_events(events_bc.pluginevents, s.options.markdown);
+
+	printf("\n\n## Metaevents\n\n");
+	print_events(events_bc.metaevents, s.options.markdown);
 
 	return run_result::exit();
 }

userspace/falco/app/actions/process_events.cpp

@@ -149,6 +149,8 @@ static falco::app::run_result do_inspect(
 	auto dumper = std::make_unique<sinsp_dumper>();
 	uint64_t dump_started_ts = 0;
 	uint64_t dump_deadline_ts = 0;
+	uint64_t dump_max_events = 0;
+	uint64_t dump_max_filesize_kb = 0;
 
 	//
 	// Start capture
@@ -178,6 +180,8 @@ static falco::app::run_result do_inspect(
 				if(dump_started_ts != 0) {
 					dump_started_ts = 0;
 					dump_deadline_ts = 0;
+					dump_max_events = 0;
+					dump_max_filesize_kb = 0;
 					dumper->close();
 				}
 			});
@@ -188,6 +192,8 @@ static falco::app::run_result do_inspect(
 				if(dump_started_ts != 0) {
 					dump_started_ts = 0;
 					dump_deadline_ts = 0;
+					dump_max_events = 0;
+					dump_max_filesize_kb = 0;
 					dumper->close();
 				}
 				s.restart.store(true);
@@ -331,6 +337,20 @@ static falco::app::run_result do_inspect(
 					if(evt_deadline_ts > dump_deadline_ts) {
 						dump_deadline_ts = evt_deadline_ts;
 					}
+					// Compute event count limit
+					auto evt_max_events = rule_res.capture_events > 0
+					                              ? rule_res.capture_events
+					                              : s.config->m_capture_default_events;
+					if(evt_max_events > dump_max_events) {
+						dump_max_events = evt_max_events;
+					}
+					// Compute file size limit
+					auto evt_max_filesize = rule_res.capture_filesize_kb > 0
+					                                ? rule_res.capture_filesize_kb
+					                                : s.config->m_capture_default_filesize_kb;
+					if(evt_max_filesize > dump_max_filesize_kb) {
+						dump_max_filesize_kb = evt_max_filesize;
+					}
 				}
 			}
 
@@ -347,14 +367,20 @@ static falco::app::run_result do_inspect(
 		}
 
 		// Save events when a dump is in progress.
-		// If the deadline is reached, close the dump.
+		// If any stop condition is reached, close the dump.
 		if(dump_started_ts != 0) {
 			dumper->dump(ev);
-			if(ev->get_ts() > dump_deadline_ts) {
+			bool stop = ev->get_ts() > dump_deadline_ts;
+			stop = stop || (dump_max_events > 0 && dumper->written_events() >= dump_max_events);
+			stop = stop || (dump_max_filesize_kb > 0 &&
+			                dumper->written_bytes() >= dump_max_filesize_kb * 1024);
+			if(stop) {
 				dumper->flush();
 				dumper->close();
 				dump_started_ts = 0;
 				dump_deadline_ts = 0;
+				dump_max_events = 0;
+				dump_max_filesize_kb = 0;
 			}
 		}
 

userspace/falco/app/options.cpp

@@ -25,35 +25,10 @@ limitations under the License.
 #include <cxxopts.hpp>
 
 #include <fstream>
-#include <algorithm>
 
 namespace falco {
 namespace app {
 
-static bool parse_output_format(const std::string &format_str,
-                                output_format &out,
-                                std::string &errstr) {
-	if(format_str.empty()) {
-		return true;
-	}
-
-	std::string lower_format = format_str;
-	std::transform(lower_format.begin(), lower_format.end(), lower_format.begin(), ::tolower);
-
-	if(lower_format == "text") {
-		out = output_format::TEXT;
-	} else if(lower_format == "markdown") {
-		out = output_format::MARKDOWN;
-	} else if(lower_format == "json") {
-		out = output_format::JSON;
-	} else {
-		errstr = "Invalid format '" + format_str + "'. Valid values are: text, markdown, json";
-		return false;
-	}
-
-	return true;
-}
-
 bool options::parse(int argc, char **argv, std::string &errstr) {
 	cxxopts::Options opts("falco", "Falco - Cloud Native Runtime Security");
 	define(opts);
@@ -106,23 +81,6 @@ bool options::parse(int argc, char **argv, std::string &errstr) {
 
 	list_fields = m_cmdline_parsed.count("list") > 0;
 
-	// Validate that both markdown and format are not specified together
-	if(m_cmdline_parsed.count("markdown") > 0 && m_cmdline_parsed.count("format") > 0) {
-		errstr = "Cannot specify both --markdown and --format options together";
-		return false;
-	}
-
-	// Parse and validate the format option
-	if(!format.empty()) {
-		if(!parse_output_format(format, output_fmt, errstr)) {
-			return false;
-		}
-	} else if(markdown) {
-		// If markdown flag is set and format is not specified, use MARKDOWN format
-		fprintf(stderr, "WARNING: --markdown is deprecated, use --format markdown instead.\n");
-		output_fmt = output_format::MARKDOWN;
-	}
-
 	return true;
 }
 
@@ -152,8 +110,7 @@ void options::define(cxxopts::Options& opts)
 		("list-events",              "List all defined syscall events, metaevents, tracepoint events and exit.", cxxopts::value<bool>(list_syscall_events))
 		("list-plugins",             "Print info on all loaded plugins and exit.", cxxopts::value(list_plugins)->default_value("false"))
 		("M",                        "Stop Falco execution after <num_seconds> are passed.", cxxopts::value(duration_to_tot)->default_value("0"), "<num_seconds>")
-		("markdown",                 "DEPRECATED: use --format markdown instead. Print output in Markdown format when used in conjunction with --list or --list-events options. It has no effect when used with other options.", cxxopts::value<bool>(markdown))
-		("format",                   "Print output in the specified <format> when used in conjunction with --list or --list-events options. Valid values are 'text', 'markdown', or 'json'. It has no effect when used with other options. Cannot be used together with --markdown.", cxxopts::value(format), "<format>")
+		("markdown",                 "Print output in Markdown format when used in conjunction with --list or --list-events options. It has no effect when used with other options.", cxxopts::value<bool>(markdown))
 		("N",                        "Only print field names when used in conjunction with the --list option. It has no effect when used with other options.", cxxopts::value(names_only)->default_value("false"))
 		("o,option",                 "Set the value of option <opt> to <val>. Overrides values in the configuration file. <opt> can be identified using its location in the configuration file using dot notation. Elements of list entries can be accessed via square brackets [].\n    E.g. base.id = val\n         base.subvalue.subvalue2 = val\n         base.list[1]=val", cxxopts::value(cmdline_config_options), "<opt>=<val>")
 		("plugin-info",              "Print info for the plugin specified by <plugin_name> and exit.\nThis includes all descriptive information like name and author, along with the\nschema format for the init configuration and a list of suggested open parameters.\n<plugin_name> can be the plugin's name or its configured 'library_path'.", cxxopts::value(print_plugin_info), "<plugin_name>")

userspace/falco/app/options.h

@@ -18,7 +18,6 @@ limitations under the License.
 #pragma once
 
 #include <libsinsp/event.h>
-#include "../../engine/output_format.h"
 
 #include <string>
 #include <vector>
@@ -58,8 +57,6 @@ public:
 	std::string print_plugin_info;
 	bool list_syscall_events = false;
 	bool markdown = false;
-	std::string format;
-	output_format output_fmt = output_format::TEXT;
 	int duration_to_tot = 0;
 	bool names_only = false;
 	std::vector<std::string> cmdline_config_options;

userspace/falco/config_json_schema.h

@@ -327,6 +327,12 @@ const char config_schema_string[] = LONG_STRING_CONST(
                 },
                 "default_duration": {
                     "type": "integer"
+                },
+                "default_events": {
+                    "type": "integer"
+                },
+                "default_filesize": {
+                    "type": "integer"
                 }
             },
             "title": "Capture"

userspace/falco/configuration.cpp

@@ -100,7 +100,9 @@ falco_configuration::falco_configuration():
         m_capture_enabled(false),
         m_capture_path_prefix("/tmp/falco"),
         m_capture_mode(capture_mode_t::RULES),
-        m_capture_default_duration_ns(5000 * 1000000LL) {
+        m_capture_default_duration_ns(5000 * 1000000LL),
+        m_capture_default_events(0),
+        m_capture_default_filesize_kb(0) {
 	m_config_schema = nlohmann::json::parse(config_schema_string);
 }
 
@@ -618,6 +620,8 @@ void falco_configuration::load_yaml(const std::string &config_name) {
 	// Convert to nanoseconds
 	m_capture_default_duration_ns =
 	        m_config.get_scalar<uint32_t>("capture.default_duration", 5000) * 1000000LL;
+	m_capture_default_events = m_config.get_scalar<uint64_t>("capture.default_events", 0);
+	m_capture_default_filesize_kb = m_config.get_scalar<uint64_t>("capture.default_filesize", 0);
 
 	m_plugins_hostinfo = m_config.get_scalar<bool>("plugins_hostinfo", true);
 

userspace/falco/configuration.h

@@ -198,6 +198,8 @@ public:
 	std::string m_capture_path_prefix;
 	capture_mode_t m_capture_mode = capture_mode_t::RULES;
 	uint64_t m_capture_default_duration_ns;
+	uint64_t m_capture_default_events;
+	uint64_t m_capture_default_filesize_kb;
 
 	// Falco engine
 	engine_kind_t m_engine_mode = engine_kind_t::KMOD;