falco-probe seems to be still loaded

[zetaab]

What happened: I have installed falco with instructions here https://github.com/falcosecurity/falco/tree/dev/integrations/k8s-using-daemonset However, when I start falco it says following:

% kubectl logs -f falco-daemonset-w7qbp -c falco
* Setting up /usr/src links from host
* Unloading falco-probe, if present
* falco-probe still loaded, waited 5s (max wait 60s)
* falco-probe still loaded, waited 10s (max wait 60s)
* falco-probe still loaded, waited 15s (max wait 60s)
* falco-probe still loaded, waited 20s (max wait 60s)
* falco-probe still loaded, waited 25s (max wait 60s)
* falco-probe still loaded, waited 30s (max wait 60s)
* falco-probe still loaded, waited 35s (max wait 60s)
* falco-probe still loaded, waited 40s (max wait 60s)
* falco-probe still loaded, waited 45s (max wait 60s)
* falco-probe still loaded, waited 50s (max wait 60s)
* falco-probe still loaded, waited 55s (max wait 60s)
* falco-probe still loaded, waited 60s (max wait 60s)
* falco-probe seems to still be loaded, hoping the best

And it does not like inform new shell in container, so I think its not working correctly.

What you expected to happen: I except that falco works

How to reproduce it (as minimally and precisely as possible): Install kube cluster with debian buster(with apparmor) and falco.

Anything else we need to know?:

Environment:

• Falco version (use falco --version):
• System info
• Cloud provider or hardware configuration: openstack
• OS (e.g: cat /etc/os-release): debian buster
• Kernel (e.g. uname -a): 4.19.0-5-cloud-amd64 Digwatch compiler #1 SMP Debian 4.19.37-5+deb10u1 (2019-07-19) x86_64 GNU/Linu
• Install tools (e.g. in kubernetes, rpm, deb, from source): kops
• Others:

[zetaab]

ah the problem was that I have already falco running in host system.

[mfdii]

Yes, Falco will try to load the module (and unload it if it's already loaded) on container start. Let us know if you have any other questions.