# Blog: Falco Weekly 4 - 2024

DevFeed: [Blog: Falco Weekly 4 - 2024](<https://devfeed.tech/articles/blog-falco-weekly-4-2024-32508.md>)

Original publisher: [Read original article](<https://falco.org/blog/falco-w-4-2024-weekly-recap/>)

Published: 2024-01-26T00:00:00Z

Content type: article

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Falco](<https://devfeed.tech/topics/falco.md>), [C++](<https://devfeed.tech/topics/c-plus-plus.md>), [eBPF](<https://devfeed.tech/topics/ebpf.md>), [CMake](<https://devfeed.tech/topics/cmake.md>), [Gke](<https://devfeed.tech/topics/gke.md>)

Tags: [c-plus-plus](<https://devfeed.tech/tags/c-plus-plus.md>), [cmake](<https://devfeed.tech/tags/cmake.md>), [deadlock](<https://devfeed.tech/tags/deadlock.md>), [deprecated](<https://devfeed.tech/tags/deprecated.md>), [ebpf](<https://devfeed.tech/tags/ebpf.md>), [enum](<https://devfeed.tech/tags/enum.md>), [falco](<https://devfeed.tech/tags/falco.md>), [gke](<https://devfeed.tech/tags/gke.md>), [process](<https://devfeed.tech/tags/process.md>), [release](<https://devfeed.tech/tags/release.md>), [testing](<https://devfeed.tech/tags/testing.md>)

## AI overview

This weekly Falco recap covers changes across the falcosecurity repositories, including the Falco 0.37.0-rc2 release, a performance-driven reversion to the older sorcery implementation, library fixes, driver and logger improvements, and updates to falcoctl and rules. It also notes experimental plugin and engine features and invites community feedback.

## Source excerpt

What happened in Falco this week? Let's go through the major changes that happened in various repositories under the falcosecurity organization. Libs Libs will need a 0.14.2 tag for the Falco 0.37.0 release, with the revert of https://github.com/falcosecurity/libs/pull/1533 PR. During our release process, we found out that the new std::filesystem based implementaton was up to 8x time slower than the old ones; that's because it supports much more cases and does many more checks. Therefore, in https://github.com/falcosecurity/libs/pull/1645, we revert to the old sorcery implementation, plus some minor improvements and added tests. Moreover, many more changes landed in libs, that won't be part of the upcoming Falco 0.37.0 release: Modernized C++ struct/enum/union declarations: https://github.com/falcosecurity/libs/pull/1588 Added support for newfstatat syscall: https://github.com/falcosecurity/libs/pull/1628 Fixed a potential deadlock for kmod: https://github.com/falcosecurity/libs/pull/1629 Big effort by our hero, Jason, to cleanup some stale macros: https://github.com/falcosecurity/libs/pull/1633,https://github.com/falcosecurity/libs/pull/1634,https://github.com/falcosecurity/libs/pull/1635,https://github.com/falcosecurity/libs/pull/1637,https://github.com/falcosecurity/libs/pull/1638 A small fix for old ebpf driver to support some GKE envs: https://github.com/falcosecurity/libs/pull/1642 Solved a data race and segfault in logger: https://github.com/falcosecurity/libs/pull/1643 Allow to selectively disable bpf and kmod engines from cmake: https://github.com/falcosecurity/libs/pull/1644 Falco Falco tag 0.37.0-rc2 is out! Try it! Moreover: syscall_event_drops was soft-deprecated to get ready for Falco 0.38.0 upcoming cleanups: https://github.com/falcosecurity/falco/pull/3015 Avoid storing escaped strings in engine: https://github.com/falcosecurity/falco/pull/3028 Bumped falcoctl to v0.7.1 and rules to 3.0.0: https://github.com/falcosecurity/falco/pull/3030,https://gith