falco
falco copied to clipboard
Send informational messages to stdout instead of stderr
Motivation
Some informational messages emitted by Falco are being sent to stderr instead of stdout. Examples:
Falco version: 0.37.1 (aarch64)
Falco initialized with configuration file: /etc/falco/falco.yaml
System info: Linux version (...)
Loading rules from file /etc/falco/falco_rules.yaml
The chosen syscall buffer dimension is: 8388608 bytes (8 MBs)
Loaded event sources: syscall
Enabled event sources: syscall
Opening 'syscall' source with modern BPF probe.
One ring buffer every '2' CPUs.
Syscall event drop monitoring:
- event drop detected: 0 occurrences
- num times actions taken: 0
This makes it hard to distinguish between real errors and just info messages.
Feature
It would be nice if all informational (and below) level messages are sent to stdout instead of stderr.
Alternatives
Additional context