From 363ab4655a47d91f8c36bf0d190874654944fd0a Mon Sep 17 00:00:00 2001 From: Melissa Kilby Date: Tue, 16 Jan 2024 04:42:36 +0000 Subject: [PATCH] update!(config): add deprecation notice for syscall_event_drops Signed-off-by: Melissa Kilby --- userspace/falco/app/actions/load_config.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/userspace/falco/app/actions/load_config.cpp b/userspace/falco/app/actions/load_config.cpp index 2433edcb10e..bb840153d2e 100644 --- a/userspace/falco/app/actions/load_config.cpp +++ b/userspace/falco/app/actions/load_config.cpp @@ -41,6 +41,12 @@ static falco::app::run_result apply_deprecated_options(falco::app::state& s) return run_result::fatal("You can not specify more than one of -e, -g (--gvisor-config), --modern-bpf, --nodriver, and the FALCO_BPF_PROBE env var"); } + if(s.config->m_min_priority == falco_common::PRIORITY_DEBUG) + { + falco_logger::log(falco_logger::level::WARNING, + "DEPRECATION NOTICE: 'syscall_event_drops' config is deprecated and will be removed in Falco 0.38! Use 'metrics' config instead. Note that the 'syscall_event_drops' config is enabled by default when the 'priority' is set to 'debug'. You can turn it off by setting the 'priority' to any higher level\n"); + } + // Please note: is not possible to mix command line options and configs to obtain a configuration // we need to use only one method. For example, is not possible to set the gvisor-config through // the command line and the gvisor-root through the config file. For this reason, if we detect