falco icon indicating copy to clipboard operation
falco copied to clipboard

Send informational messages to stdout instead of stderr

Open pirxthepilot opened this issue 1 year ago • 0 comments

Motivation

Some informational messages emitted by Falco are being sent to stderr instead of stdout. Examples:

Falco version: 0.37.1 (aarch64)
Falco initialized with configuration file: /etc/falco/falco.yaml
System info: Linux version (...)
Loading rules from file /etc/falco/falco_rules.yaml
The chosen syscall buffer dimension is: 8388608 bytes (8 MBs)
Loaded event sources: syscall
Enabled event sources: syscall
Opening 'syscall' source with modern BPF probe.
One ring buffer every '2' CPUs.
Syscall event drop monitoring:
   - event drop detected: 0 occurrences
   - num times actions taken: 0

This makes it hard to distinguish between real errors and just info messages.

Feature

It would be nice if all informational (and below) level messages are sent to stdout instead of stderr.

Alternatives

Additional context

pirxthepilot avatar Oct 05 '24 21:10 pirxthepilot