Use --modern-bpf as a fallback when /dev/scap0 does not exist?

[apteryks]

Hello,

I've built sysdig with falcosecurity-libs that were built with the eBPF support only (modern BPF). I did not build the kernel driver. I find it strange/inconvenient that I need to remember to use sysdig --modern-bpf every time I use it. Sure, I could define a local alias for it, but that's a boot user experience in my opinion. Perhaps sysdig could automatically detect/use modern-bpf when the probe type was not specified?

Thank you!

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[apteryks]

/remove-stale