New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Falco engine should add '*' to the beginning of its outputs #180

Closed

mstemm opened this issue Dec 30, 2016 · 1 comment

Contributor

mstemm commented Dec 30, 2016

When the falco engine matches an event to a rule, it returns the rule's name, priority, and output string.

Later, in the outputs module, the output string is prefixed with '*' to ensure that if an event doesn't have a matching value for a given %xxx field, the rest of the values are filled in. See https://github.com/draios/sysdig/wiki/Sysdig-User-Guide#output-formatting for details.

The engine should really just add the '*' prefix itself so the outputs module doesn't have to.

Contributor Author

mstemm commented Jan 5, 2017

This was fixed in #181, closing.

mstemm closed this as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment