Action Items (TL;DR) Adjust the buf_size_preset in the falco.yaml config. Utilize base_syscalls to limit the syscalls under monitoring. Audit and optimize Falco rules to prevent unnecessary backpressure on the kernel, considering that Falco’s main event stream is single-threaded.
Docs: Falco Is Dropping Syscalls Events
calendar_today
January 1, 2001
domain
falco