Open cccsss01 opened 8 months ago
Have you explored the base_syscalls option in falco.yaml?
We are also working on adding bunch of new debugging guides and rewrite most of the install guides.
Wanna get more closely involved?
I'm already time slotted during the community call. I've joined a few when I was free. I was not familiar with base calls, which looks great. Maybe a PR to just link something for additional use case see base calls. I don't mind doing the PR asthetics tho..
Awesome, if you have suggestions where and how to cross-reference this better plz let us know and of course always feel free to open a PR. Was planning to also work on some help guides around performance and such, see https://github.com/falcosecurity/falco-website/issues/1229#issuecomment-1878149234
Any way to add a new link to supported events for "advanced syscalls" then link it to that portion of the helm chart? :O I think that would be nice.
Agreed, for example could link to https://falco.org/blog/adaptive-syscalls-selection/ and also mention to checkout the config desc in the falco.yaml file.
Re helm chart @leogr can be your point of contact.
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale
.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close
.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
Any way to add a new link to supported events for "advanced syscalls" then link it to that portion of the helm chart? :O I think that would be nice.
@alacuku wdyt?
cc @LucaGuerra @Issif
Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten
.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close
.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle rotten
/remove-lifecycle rotten /assign @LucaGuerra
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale
.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close
.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
/area documentation
What would you like to be added: https://falco.org/docs/reference/rules/supported-events/#syscall-events
Note that, for performance reasons, by default Falco will only consider a subset of them indicated in the table below with "yes". However, it's possible to make Falco consider all events by using the -A command line switch.
for example: falco --modern-bpf -A
it would be great if there was a way to specifically select additional syscalls in the document.
Why is this needed: clarity.