How to stop discarding system calls before falco processing

[zhiyuan-wan]

Hi there,
As the wiki page https://github.com/draios/falco/wiki/Falco-Rules says, for performance consideration, the sysdig logs of a list of system calls are discarded before falco processing. However, I would like to collect the complete system call list of a running process.
I wonder how I can stop falco discard system calls before processing.

Thanks,
Zhiyuan

[mstemm]

That behavior isn't controllable by any command line option right now. If you can build from source, https://github.com/draios/falco/blob/dev/userspace/falco/falco.cpp#L405 is where the inspector sets EF_DROP_FALCO, which starts the dropping of nonessential system calls.

I'll see if I can make it configurable on the command line.