9 ms·
It uses Falco libs[1] underneath, which supports capture using eBPF or a kmod. I work with the Falco libs team and they go to great lengths to minimize overhead
by geraldcombs 2y ago
It uses Falco libs[1] underneath, which supports capture using eBPF or a kmod. I work with the Falco libs team and they go to great lengths to minimize overhead.
[1]https://github.com/falcosecurity/libs/ https://github.com/falcosecurity/libs/