{"id":1209,"date":"2026-10-11T04:50:58","date_gmt":"2026-10-11T04:50:58","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/?p=1209"},"modified":"2026-10-11T08:08:22","modified_gmt":"2026-10-11T08:08:22","slug":"falcosidekick-on-ubuntu-complete-installation-configuration-alert-forwarding-and-troubleshooting-tutorial","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/falcosidekick-on-ubuntu-complete-installation-configuration-alert-forwarding-and-troubleshooting-tutorial\/","title":{"rendered":"Falcosidekick on Ubuntu: Complete Installation, Configuration, Alert Forwarding, and Troubleshooting Tutorial"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">I read your <a href=\"https:\/\/www.devopsschool.com\/tutorials\/falco-zero-to-intermediate-gold-standard-hands-on-master-tutorial\/\">Falco: Zero to Intermediate \u2013 Gold-Standard Hands-on Master Tutorial<\/a>. It uses Ubuntu Server 24.04 LTS as its reference lab and covers Falco installation, runtime detection, alerts, and integrations.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/www.google.com\/s2\/favicons?domain=https:\/\/www.devopsschool.com&amp;sz=32\" alt=\"\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Tutorials<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let&#8217;s extend that tutorial with a practical, end-to-end lab: install Falcosidekick on Ubuntu, connect it to Falco, generate test security events, and investigate the alerts.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Understand what we are building<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ubuntu 24.04 \u2014 Falco<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Detects suspicious runtime activity<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HTTP POST \u2014 JSON events<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Falcosidekick \u2014 port 2801<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Receives, enriches and forwards alerts<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HTTP forwarding<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Falcosidekick UI \u2014 optional<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Visual alert investigation, normally port 2802<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Falco is the detection engine. Falcosidekick is the alert-routing component; it is not itself the security detector. The UI is a separate component. On a standalone Ubuntu host, we can install Falcosidekick as a systemd service and configure Falco to send it JSON events over HTTP.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/www.google.com\/s2\/favicons?domain=https:\/\/github.com&amp;sz=32\" alt=\"\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">GitHub<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">+1<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Our lab goals<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Confirm that Falco is working.<\/li>\n\n\n\n<li>Install and start Falcosidekick.<\/li>\n\n\n\n<li>Connect Falco to Falcosidekick.<\/li>\n\n\n\n<li>Generate safe, controlled test activity.<\/li>\n\n\n\n<li>View the alerts and investigate the process, command, user, and event priority.<\/li>\n\n\n\n<li>Troubleshoot events that do not arrive.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">2. Step 1 \u2014 Check your Ubuntu and Falco installation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Run these commands on your Ubuntu server or VM.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Check Ubuntu version\nlsb_release -a\n\n# Check CPU architecture\nuname -m\n\n# Check Linux kernel\nuname -r\n\n# Check whether Falco is installed\nfalco --version\n\n# Find installed Falco services\nsystemctl list-unit-files | grep -i falco\n\n# Check the Falco service status\nsudo systemctl status falco-modern-bpf.service --no-pager<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The tutorial uses the service <code>falco-modern-bpf.service<\/code> for its modern eBPF lab. Your installation might use a different service name, so check the service list if the last command reports that the unit does not exist.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/www.google.com\/s2\/favicons?domain=https:\/\/www.devopsschool.com&amp;sz=32\" alt=\"\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Tutorials<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If Falco is already running, continue to Step 2. If it is not installed, use the official <a href=\"https:\/\/falco.org\/docs\/getting-started\/falco-linux-quickstart\/\">Falco Linux installation guide<\/a> to install it and configure a supported driver before proceeding.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Step 2 \u2014 Install Falcosidekick on Ubuntu<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We will install Falcosidekick as a native Linux service rather than using Kubernetes or Docker. This is suitable for a standalone Ubuntu lab.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3.1 Install the required utilities<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt-get update\nsudo apt-get install -y curl wget ca-certificates tar<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">3.2 Download the latest Falcosidekick release<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The following commands discover the latest GitHub release and download the correct archive for an x86-64 or ARM64 machine.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Detect the machine architecture\nARCH=\"$(dpkg --print-architecture)\"\n\ncase \"$ARCH\" in\n  amd64)  SIDekICK_ARCH=\"amd64\" ;;\n  arm64)  SIDekICK_ARCH=\"arm64\" ;;\n  *)\n    echo \"Unsupported architecture: $ARCH\"\n    exit 1\n    ;;\nesac\n\n# Get the latest release tag from GitHub\nVERSION=\"$(curl -fsSL \\\n  https:\/\/api.github.com\/repos\/falcosecurity\/falcosidekick\/releases\/latest \\\n  | grep '\"tag_name\":' \\\n  | head -n 1 \\\n  | cut -d '\"' -f 4)\"\n\necho \"Architecture: $ARCH\"\necho \"Release: $VERSION\"\n\n# Download the matching release archive\ncurl -fL \\\n  \"https:\/\/github.com\/falcosecurity\/falcosidekick\/releases\/download\/${VERSION}\/falcosidekick_${VERSION}_linux_${SIDekICK_ARCH}.tar.gz\" \\\n  -o \/tmp\/falcosidekick.tar.gz<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check the release and archive before extracting:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Inspect the downloaded archive\ntar -tzf \/tmp\/falcosidekick.tar.gz | head -n 20\n\n# Extract into a temporary directory\nmkdir -p \/tmp\/falcosidekick-install\ntar -xzf \/tmp\/falcosidekick.tar.gz \\\n  -C \/tmp\/falcosidekick-install\n\n# Locate the binary\nfind \/tmp\/falcosidekick-install -type f -name falcosidekick<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the archive contains the binary at the expected path, install it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Install the executable\nsudo install -m 0755 \\\n  \/tmp\/falcosidekick-install\/falcosidekick \\\n  \/usr\/local\/bin\/falcosidekick\n\n# Verify the binary\n\/usr\/local\/bin\/falcosidekick --help<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">These steps follow the project&#8217;s documented native-host installation approach.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/www.google.com\/s2\/favicons?domain=https:\/\/github.com&amp;sz=32\" alt=\"\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">GitHub<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the download returns 404: inspect the current release assets at <a href=\"https:\/\/github.com\/falcosecurity\/falcosidekick\/releases\">Falcosidekick releases<\/a> and adjust the archive filename to match the published asset.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">4. Step 3 \u2014 Create the Falcosidekick configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Create the configuration directory:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo mkdir -p \/etc\/falcosidekick<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Create the configuration file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tee \/etc\/falcosidekick\/config.yaml &gt; \/dev\/null &lt;&lt;'EOF'\n# Falcosidekick listener configuration\nlistenaddress: \"127.0.0.1\"\nlistenport: 2801\n\n# Keep debug disabled unless troubleshooting\ndebug: false\nEOF<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This configuration binds Falcosidekick to the local loopback interface on port <code>2801<\/code>. That is appropriate when Falco and Falcosidekick run on the same Ubuntu machine.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Check the configuration:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo cat \/etc\/falcosidekick\/config.yaml<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For this first lab, we are not configuring Slack, email, a SIEM, or any other external destination. Falcosidekick can receive alerts without an external forwarding integration. For additional configuration options, see the <a href=\"https:\/\/github.com\/falcosecurity\/falcosidekick\">official Falcosidekick project documentation<\/a>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/www.google.com\/s2\/favicons?domain=https:\/\/github.com&amp;sz=32\" alt=\"\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">GitHub<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">5. Step 4 \u2014 Create a systemd service<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Create the service file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tee \/etc\/systemd\/system\/falcosidekick.service &gt; \/dev\/null &lt;&lt;'EOF'\n&#91;Unit]\nDescription=Falcosidekick Alert Forwarder\nAfter=network.target\n\n&#91;Service]\nType=simple\nExecStart=\/usr\/local\/bin\/falcosidekick -c \/etc\/falcosidekick\/config.yaml\nRestart=on-failure\nRestartSec=5\n\n&#91;Install]\nWantedBy=multi-user.target\nEOF<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Reload systemd and start Falcosidekick:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Tell systemd to load the new service\nsudo systemctl daemon-reload\n\n# Enable startup after reboot and start now\nsudo systemctl enable --now falcosidekick\n\n# Check the service\nsudo systemctl status falcosidekick --no-pager\n\n# Read recent logs\nsudo journalctl -u falcosidekick -n 50 --no-pager<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Test its health endpoint:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -i http:\/\/127.0.0.1:2801\/healthz<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Expected result: an HTTP <code>200<\/code> status. If the service is not running, check its journal for configuration errors or port conflicts before moving on.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/www.google.com\/s2\/favicons?domain=https:\/\/github.com&amp;sz=32\" alt=\"\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">GitHub<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">6. Step 5 \u2014 Connect Falco to Falcosidekick<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is the most important step. Installing Falcosidekick alone does not automatically connect it to Falco.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6.1 Back up the existing Falco configuration<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code># Back up the main configuration before editing\nsudo cp -a \/etc\/falco\/falco.yaml \\\n  \/etc\/falco\/falco.yaml.before-falcosidekick\n\n# Find the relevant existing settings\nsudo grep -nE \\\n  '^(json_output:|json_include_output_property:|http_output:|  enabled:|  url:)' \\\n  \/etc\/falco\/falco.yaml<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">6.2 Edit the Falco configuration<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nano \/etc\/falco\/falco.yaml<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Find the existing top-level JSON and HTTP output settings. Enable JSON output and HTTP forwarding, using the following values:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Emit structured JSON alerts\njson_output: true\n\n# Include the human-readable alert output in the JSON\njson_include_output_property: true\n\n# Forward Falco alerts to Falcosidekick\nhttp_output:\n  enabled: true\n  url: \"http:\/\/127.0.0.1:2801\/\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Important: merge these values into the existing configuration. Do not append duplicate top-level keys or replace the entire file. Keep any other settings that your Falco installation needs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The HTTP output URL must point to the address where Falcosidekick is listening. For a single-host lab, both services can use <code>127.0.0.1<\/code>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/www.google.com\/s2\/favicons?domain=https:\/\/github.com&amp;sz=32\" alt=\"\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">GitHub<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">+1<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6.3 Validate and restart Falco<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">First, check the configuration and rules:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Validate Falco's configuration before restarting\nsudo falco --dry-run -c \/etc\/falco\/falco.yaml<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If validation succeeds, restart the service that is actually running on your machine. For the tutorial&#8217;s modern eBPF service:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl restart falco-modern-bpf.service\n\n# Confirm Falco is running\nsudo systemctl is-active falco-modern-bpf.service\n\n# Review startup messages and errors\nsudo journalctl -u falco-modern-bpf.service \\\n  -n 60 --no-pager<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If your system uses another Falco unit, replace <code>falco-modern-bpf.service<\/code> with that unit&#8217;s name.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Check Falcosidekick again:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl is-active falcosidekick\n\ncurl -sS -i http:\/\/127.0.0.1:2801\/healthz<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">At this point, Falco should be configured to forward its alerts to Falcosidekick.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">7. Step 6 \u2014 Generate a controlled security event<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Let&#8217;s generate an attempted read of a sensitive Linux file without changing or deleting anything.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Run this command as your normal, non-root user \u2014 do not prefix it with <code>sudo<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Attempt to read the protected shadow file\ncat \/etc\/shadow &gt; \/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">On a normally configured Ubuntu host, this should fail with a permission-denied message. That is expected.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now inspect Falco&#8217;s logs:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Look for recent Falco detections\nsudo journalctl -u falco-modern-bpf.service \\\n  --since \"5 minutes ago\" --no-pager<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Look for an alert related to sensitive-file access, if a matching rule is loaded and the event is captured. The exact rule name depends on your installed ruleset.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Next, inspect Falcosidekick:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Check whether the receiver reports errors\nsudo journalctl -u falcosidekick \\\n  --since \"5 minutes ago\" --no-pager<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Falcosidekick does not necessarily print every received alert to its service log when debug mode is disabled. Therefore, an empty log does not prove that no alert arrived.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">8. Step 7 \u2014 View Falco alerts in a web dashboard<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">One important distinction: Falcosidekick alone is not an event-history dashboard. To browse alerts in a UI, use Falcosidekick-UI with Redis. Redis stores the events, and the UI displays them.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/www.google.com\/s2\/favicons?domain=https:\/\/github.com&amp;sz=32\" alt=\"\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">GitHub<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">+1<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The following is an optional dashboard setup using Docker on the same Ubuntu host.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">8.1 Install Docker if it is not already installed<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If Docker is already working, skip this step. Otherwise, follow the <a href=\"https:\/\/docs.docker.com\/engine\/install\/ubuntu\/\">official Docker Engine installation guide for Ubuntu<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Verify:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>docker --version\nsudo docker info<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">8.2 Start Redis with the required search module<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Falcosidekick-UI requires Redis with the RediSearch module. For this learning lab, start the documented Redis Stack-compatible image:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo docker network create falco-net\n\nsudo docker run -d \\\n  --name falco-redis \\\n  --restart unless-stopped \\\n  --network falco-net \\\n  -p 127.0.0.1:6379:6379 \\\n  redislabs\/redisearch:2.2.4<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check Redis:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo docker ps\nsudo docker logs --tail 30 falco-redis<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">8.3 Start Falcosidekick-UI<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo docker run -d \\\n  --name falcosidekick-ui \\\n  --restart unless-stopped \\\n  --network falco-net \\\n  -p 2802:2802 \\\n  -e FALCOSIDEKICK_UI_REDIS_URL=falco-redis:6379 \\\n  -e 'FALCOSIDEKICK_UI_USER=labadmin:ChangeThisPassword123!' \\\n  falcosecurity\/falcosidekick-ui<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The official UI supports a configurable Redis address and login credentials.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/www.google.com\/s2\/favicons?domain=https:\/\/github.com&amp;sz=32\" alt=\"\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">GitHub<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Check the UI container:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo docker ps\nsudo docker logs --tail 50 falcosidekick-ui\n\n# Test the UI health endpoint\ncurl -i http:\/\/127.0.0.1:2802\/healthz<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the container cannot connect to Redis, remember that <code>127.0.0.1<\/code> inside a container refers to that container itself. In that case, configure both containers on a shared Docker network and set the UI&#8217;s Redis address to <code>falco-redis:6379<\/code> instead.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">8.4 Connect Falcosidekick to the UI<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Edit the Falcosidekick configuration:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo nano \/etc\/falcosidekick\/config.yaml<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Add the UI output settings to the existing configuration:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Falcosidekick listener\nlistenaddress: \"127.0.0.1\"\nlistenport: 2801\n\ndebug: false\n\n# Forward received alerts to Falcosidekick-UI\nwebui:\n  enabled: true\n  url: \"http:\/\/127.0.0.1:2802\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The UI output configuration uses the <code>webui<\/code> output. Check the exact keys supported by your installed Falcosidekick release in its <a href=\"https:\/\/github.com\/falcosecurity\/falcosidekick\">official configuration reference<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Restart the receiver:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl restart falcosidekick\n\nsudo systemctl status falcosidekick --no-pager\n\nsudo journalctl -u falcosidekick -n 50 --no-pager<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Open the dashboard on the Ubuntu machine:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dashboard URL<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"http:\/\/127.0.0.1:2802\/\">http:\/\/127.0.0.1:2802<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Log in using the username and password configured for the UI container.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If Ubuntu is a remote server, use SSH port forwarding from your local computer:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh -L 2802:127.0.0.1:2802 YOUR_USER@YOUR_SERVER_IP<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then open <code>http:\/\/127.0.0.1:2802<\/code> in your local browser. Do not expose the dashboard or Redis ports publicly for this lab.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">9. Step 8 \u2014 Trigger an alert and investigate it<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Repeat the controlled test:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Run as a normal, non-root user\ncat \/etc\/shadow &gt; \/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Open the dashboard and select the events view. If the loaded ruleset detects this attempt, inspect the event details.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Look for the following fields:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><th>Field<\/th><th>What it tells you<\/th><\/tr><tr><td><code>rule<\/code><\/td><td>Which Falco detection matched<\/td><\/tr><tr><td><code>priority<\/code><\/td><td>Severity assigned by the rule<\/td><\/tr><tr><td><code>output<\/code><\/td><td>Human-readable description of the event<\/td><\/tr><tr><td><code>time<\/code><\/td><td>When the event occurred<\/td><\/tr><tr><td><code>hostname<\/code><\/td><td>Which host generated it<\/td><\/tr><tr><td><code>proc.name<\/code><\/td><td>Process name<\/td><\/tr><tr><td><code>user.name<\/code><\/td><td>User associated with the event<\/td><\/tr><tr><td><code>fd.name<\/code><\/td><td>File or descriptor involved, when available<\/td><\/tr><tr><td><code>container.id<\/code><\/td><td>Container context, if applicable<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Not every event will include every field. The available details depend on the matching rule and event source. An alert is evidence to investigate, not automatic proof of a compromise.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/www.google.com\/s2\/favicons?domain=https:\/\/www.devopsschool.com&amp;sz=32\" alt=\"\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Tutorials<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">+1<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step 9 \u2014 Troubleshoot when no alerts appear<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Work through this checklist in order.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Troubleshooting checklist<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">0 of 7Falco is active<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">sudo systemctl is-active falco-modern-bpf.service<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Copy commandFalcosidekick is active<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">sudo systemctl is-active falcosidekick<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Copy commandReceiver health check passes<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">curl -i http:\/\/127.0.0.1:2801\/healthz<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Copy commandFalco HTTP output is enabled<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">sudo grep -nA3 &#8216;^http_output:&#8217; \/etc\/falco\/falco.yaml<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Copy commandFalco logs contain detections or errors<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">sudo journalctl -u falco-modern-bpf.service &#8211;since &#8217;10 minutes ago&#8217; &#8211;no-pager<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Copy commandFalcosidekick logs show errors<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">sudo journalctl -u falcosidekick &#8211;since &#8217;10 minutes ago&#8217; &#8211;no-pager<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Copy commandReceiver metrics are available<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">curl -fsS http:\/\/127.0.0.1:2801\/metrics | head -n 40<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Copy command<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">How to interpret the results:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Falco is active, but no detection appears: verify that the ruleset is loaded and the test actually matches a rule.<\/li>\n\n\n\n<li>Falco logs show an alert, but the UI is empty: investigate HTTP forwarding, the Falcosidekick <code>webui<\/code> output, Redis connectivity, and UI logs.<\/li>\n\n\n\n<li>The receiver health check fails: check the systemd service and whether port <code>2801<\/code> is already occupied.<\/li>\n\n\n\n<li>No HTTP output is configured: correct <code>http_output<\/code> in Falco&#8217;s configuration, validate it, and restart the correct service.<\/li>\n\n\n\n<li>Events arrive but are too noisy: review rule priorities, exclusions, and the expected behavior of the workload before tuning rules.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">11. Final verification<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Your lab is complete when all of these are true:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Falco is running and loading rules.<\/li>\n\n\n\n<li>Falcosidekick responds on port <code>2801<\/code>.<\/li>\n\n\n\n<li>Falco&#8217;s HTTP output points to Falcosidekick.<\/li>\n\n\n\n<li>A controlled test generates an alert when a matching rule is loaded.<\/li>\n\n\n\n<li>The event reaches the UI and is visible with its rule, priority, timestamp, and available process details.<\/li>\n\n\n\n<li>You can diagnose a missing event by checking Falco, the receiver, and the UI separately.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Official references<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.devopsschool.com\/tutorials\/falco-zero-to-intermediate-gold-standard-hands-on-master-tutorial\/\">Falco installation and configuration tutorial<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/falcosecurity\/falcosidekick\">Falcosidekick installation and configuration<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/falcosecurity\/falcosidekick-ui\">Falcosidekick-UI documentation<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/falco.org\/docs\/concepts\/outputs\/forwarding\/\">Falco output forwarding<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>I read your Falco: Zero to Intermediate \u2013 Gold-Standard Hands-on Master Tutorial. It uses Ubuntu Server 24.04 LTS as its reference lab and covers Falco installation, runtime&#8230; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1209","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1209","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=1209"}],"version-history":[{"count":3,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1209\/revisions"}],"predecessor-version":[{"id":1212,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1209\/revisions\/1212"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=1209"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=1209"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=1209"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}