Use --modern-bpf as a fallback when /dev/scap0 does not exist?

[apteryks]

Hello,

I've built sysdig with falcosecurity-libs that were built with the eBPF support only (modern BPF). I did not build the kernel driver. I find it strange/inconvenient that I need to remember to use sysdig --modern-bpf every time I use it. Sure, I could define a local alias for it, but that's a boot user experience in my opinion. Perhaps sysdig could automatically detect/use modern-bpf when the probe type was not specified?

Thank you!

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[apteryks]

/remove-stale

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[apteryks]

Common, bot.

[beaugunderson]

Just ran into this as well as a new user; even if it doesn't automatically apply --modern-bpf for you it should at least point out that the option is there in the error message.

[apteryks]

Can we reopen this? I may be interested on contributing a fix to this if I can make some time.