Skip to content

Commit

Permalink
Use better way to skip falco events
Browse files Browse the repository at this point in the history
Use the new method falco_consider() to determine which events to
skip. This centralizes the logic in a single function. All events will
still be considered if falco was run with -A.

This depends on draios/sysdig#1105.
  • Loading branch information
mstemm committed Apr 24, 2018
1 parent 6be4830 commit 942206d
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions userspace/falco/falco.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,8 @@ uint64_t do_inspect(falco_engine *engine,
falco_outputs *outputs,
sinsp* inspector,
uint64_t duration_to_tot_ns,
string &stats_filename)
string &stats_filename,
bool all_events)
{
uint64_t num_evts = 0;
int32_t res;
Expand Down Expand Up @@ -218,8 +219,7 @@ uint64_t do_inspect(falco_engine *engine,
}
}

if(!inspector->is_debug_enabled() &&
ev->get_category() & EC_INTERNAL)
if(!ev->falco_consider() && !all_events)
{
continue;
}
Expand Down Expand Up @@ -761,7 +761,8 @@ int falco_init(int argc, char **argv)
outputs,
inspector,
uint64_t(duration_to_tot*ONE_SECOND_IN_NS),
stats_filename);
stats_filename,
all_events);

duration = ((double)clock()) / CLOCKS_PER_SEC - duration;

Expand Down

0 comments on commit 942206d

Please sign in to comment.