Configure the Falco deployment to run without Falcosidekick. This means that the events are only stored in the Falco pod stdout log.
Why is this needed:
As a user I want to scrape Falco event logs myself and not rely on Falcosidekick to send events to an event store. This can be done today already, however events are still sent to a central event store.
lsroe
commented
4 days ago
What would you like to be added:
Configure the Falco deployment to run without Falcosidekick. This means that the events are only stored in the Falco pod stdout log.
Why is this needed:
As a user I want to scrape Falco event logs myself and not rely on Falcosidekick to send events to an event store. This can be done today already, however events are still sent to a central event store.