LNX
Falco - Linux
Cloud Native Computing FoundationAlerts via syslog
journalctl _COMM=falco- The unit is falco-modern-bpf.service.Falco
2 log locations · Linux
Where Falco keeps its logs
Falco logs to journalctl _COMM=falco on Linux. 1 other Linux log location is recorded below, including paths for Debian/Ubuntu.
Paths are printed exactly as Falco writes them. Environment variables like %LOCALAPPDATA% and $XDG_STATE_HOME are never expanded, so a path can be pasted straight into a shell. Where a path differs between installer types or shipping flavours, each one is racked as its own card below - why that happens.
Finding your way around Linux.
LNX
Alerts via syslog
/var/log/syslog- /var/log/messages on RHEL.