diff --git a/test/falco_test.py b/test/falco_test.py index 41d83912f49..3b9af17090e 100644 --- a/test/falco_test.py +++ b/test/falco_test.py @@ -31,6 +31,7 @@ def setUp(self): self.json_output = self.params.get('json_output', '*', default=False) self.json_include_output_property = self.params.get('json_include_output_property', '*', default=True) + self.all_events = self.params.get('all_events', '*', default=False) self.priority = self.params.get('priority', '*', default='debug') self.rules_file = self.params.get('rules_file', '*', default=os.path.join(self.basedir, '../rules/falco_rules.yaml')) @@ -365,6 +366,9 @@ def test(self): if self.run_duration: cmd += ' -M {}'.format(self.run_duration) + if self.all_events: + cmd += ' -A' + self.falco_proc = process.SubProcess(cmd) res = self.falco_proc.run(timeout=180, sig=9) diff --git a/test/falco_tests.yaml b/test/falco_tests.yaml index 74ca66fd4d4..6c5afd1460e 100644 --- a/test/falco_tests.yaml +++ b/test/falco_tests.yaml @@ -128,6 +128,7 @@ trace_files: !mux - rules/single_rule.yaml - rules/double_rule.yaml trace_file: trace_files/cat_write.scap + all_events: True rules_directory: detect: True @@ -138,6 +139,7 @@ trace_files: !mux rules_file: - rules/rules_dir trace_file: trace_files/cat_write.scap + all_events: True multiple_rules_suppress_info: detect: True @@ -153,6 +155,7 @@ trace_files: !mux - rules/single_rule.yaml - rules/double_rule.yaml trace_file: trace_files/cat_write.scap + all_events: True multiple_rules_overriding: detect: False @@ -699,6 +702,7 @@ trace_files: !mux - detect_madvise: 2 - detect_open: 2 trace_file: trace_files/syscall.scap + all_events: True catchall_order: detect: True diff --git a/userspace/falco/falco.cpp b/userspace/falco/falco.cpp index d07c30aee8f..5e324fb5fff 100644 --- a/userspace/falco/falco.cpp +++ b/userspace/falco/falco.cpp @@ -151,7 +151,8 @@ uint64_t do_inspect(falco_engine *engine, falco_outputs *outputs, sinsp* inspector, uint64_t duration_to_tot_ns, - string &stats_filename) + string &stats_filename, + bool all_events) { uint64_t num_evts = 0; int32_t res; @@ -218,8 +219,7 @@ uint64_t do_inspect(falco_engine *engine, } } - if(!inspector->is_debug_enabled() && - ev->get_category() & EC_INTERNAL) + if(!ev->falco_consider() && !all_events) { continue; } @@ -761,7 +761,8 @@ int falco_init(int argc, char **argv) outputs, inspector, uint64_t(duration_to_tot*ONE_SECOND_IN_NS), - stats_filename); + stats_filename, + all_events); duration = ((double)clock()) / CLOCKS_PER_SEC - duration;