github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-11 11:39:32 +00:00
Code Issues Projects Releases Wiki Activity

Updated Falco Formatting for Containers and Orchestration (markdown)

Mark Stemm
2016-10-24 15:55:02 -07:00
parent 9048424d59
commit 21bf6f8093
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
Falco-Formatting-for-Containers-and-Orchestration.md

@@ -4,11 +4,11 @@ Like sysdig, falco can be run with `-pk`/`-pm`/`-pc`/`-p` arguments that change
The information from k8s/mesos/containers is used in conjunction with the command line options in these ways: The information from k8s/mesos/containers is used in conjunction with the command line options in these ways:
* In rule outputs, if the format string contains %container.info, that is replaced with the value from -pk/-pm/-pc, if one of those options was provided. If no option was provided, %container.info is replaced with a generic %container.name (id=%container.id) instead. * In rule outputs, if the format string contains `%container.info`, that is replaced with the value from `-pk`/`-pm`/`-pc`, if one of those options was provided. If no option was provided, `%container.info` is replaced with a generic `%container.name (id=%container.id)` instead.
* If the format string does not contain %container.info, and one of -pk/-pm/-pc was provided, that is added to the end of the formatting string. * If the format string does not contain `%container.info`, and one of `-pk`/`-pm`/`-pc` was provided, that is added to the end of the formatting string.
* If -p was specified with a general value (i.e. not -pk/-pm/-pc), the value is simply added to the end and any %container.info is replaced with the generic value. * If `-p` was specified with a general value (i.e. not `-pk`/`-pm`/`-pc`), the value is simply added to the end and any `%container.info` is replaced with the generic value.
## Examples ## Examples