Melissa Kilby

@petterreinholdtsen would it be possible to instead use the new https://falco.org/docs/metrics/falco-metrics/ framework as it supports monotonic counters? That way we know more accurately how many dropped events there are since...

Re https://falco.org/docs/metrics/falco-metrics/ you can adjust the timer aka how often you want to emit a log. Just FYI. > Error File below / or /root opened for writing (file=cf_lock.lmdb.lock nameraw=cf_lock.lmdb.lock...

Given your examples above https://github.com/falcosecurity/falco/issues/3120#issuecomment-1976190802 effectively the derivation of `fd.name` is more sophisticated and perhaps `fs.path.name` is actually wrong here. `fs.path.name` always concatenates the `proc.cwd` and the raw open* syscall...

I also believe it should be kept within the file. If we worry about it being cumbersome to scroll down, we could move all configs up and instead have all...

> Maybe we can have just a short description close to the relevant setting, and long descriptions at the end of the file Works, a one-liner TLDR and the more...

/milestone 0.38.0

> One thought after a quick look. > > I would like to group some top-level config keys instead of continuously adding new ones. > > I mean, the top-level...

> @Andreagit97 that's a great idea actually, even if it is exposing some "internal knowledge" about who owns what. I'd rather call it just `falco-libs:`. `falco_libs` with underscore instead? Perhaps...

@geraldcombs using the latest libs commit and also rebased w/ falco master, still having the windows failure. Could you take another look? Thank you!

Thanks @geraldcombs I'll then rebase, thanks!