The latest version of Falco adds the ability to handle multiple concurrent event sources within the same instance, support for selecting which system calls to capture, a new kernel crawler to collect the latest supported kernel versions, and more.
Until version 0.33.0, the only way for Falco to consume events from multiple event sources was to deploy multiple instances of Falco, one for each event source. This was particularly limiting in the face of Falco’s plugin system, which made it possible to go beyond syscall tracing by adding new types of event sources as of Falco 0.32.
This is a huge improvement and also brings back support for running syscall and k8s audit logs on the same Falco instance, for anyone interested in doing so.
This new feature introduces a user-facing change, as each Falco instance enables syscall event sources by default, meaning you’ll have to explicitly disable syscalls if you want a plugin-only deployment.
Falco 0.33 also introduces new libsinsp APIs that allow you to individually select which kernel syscalls and tracepoint events should be collected. This is a step forward compared to the previous “simple consumption mode”, which was able to discard unhelpful events for runtime security purposes. Selecting individual syscalls and events should improve Falco’s performance and reduce the amount of dropped events.
Relatedly, the new release of Falco further attempts to mitigate the dropped events problem by giving control over the size of the kernel syscall ring buffer, which is the shared memory where drivers store events for Falco to consume at a moment’s notice rear. By adjusting the buffer size, you can control how often Falco will drop events.
As mentioned, the kernel tracker is a new tool that automatically searches for new kernel versions that are compatible with a number of Linux distributions. It should make it easier to adopt Falco by simplifying the task of installing kernel modules and eBPF probes for a given kernel version. The kernel tracker is used to populate and maintain a database with the build matrix that lists all kernel versions and distributions supported by Falco.
The latest version of Falco brings many additional features and improvements, including new drivers for minikube, improved rate limiting for alerts, and new security rules and supported systems. Don’t miss the official announcement or changelog for all the details.