<p>I am using runtime detection tool Falco to analyse the container behavior for at least 40 seconds, using filters that detect newly spawning and executing processes store the incident file art /opt/falco-incident.txt containing the detected incidents. I try to format the output result one per line, in the format [timestamp],[uid],[user-name],[processName]</p>
<p>I created the yaml file audit.yaml</p>
<pre><code>apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: Metadata
  namespace: &quot;&quot;
  verb: &quot;&quot;
  resources:
  - group: &quot;&quot;
    resource: &quot;&quot;
  - name: audit
    hostPath:
      path: /etc/kubernetes/audit.yaml
      type: File
  - name: audit-log
    hostPath:
      path: /var/log/all-resources.log
      type: FileOrCreate
  - mountPath: /etc/kubernetes/audit.yaml
    name: audit
    readOnly: true
  - mountPath: /var/log/all-resources.log
    name: audit-log
    readOnly: false
</code></pre>
<p>I edited the kube-apiserver with adding this 3 lines</p>
<pre><code> - --audit-policy-file=/etc/kubernetes/audit.yaml
 - --audit-log-path=/var/log/all-resources.log
 - --audit-log-maxage=1 
</code></pre>
<p>The main question is: How and where to define the desired output which should look like this ?</p>
<p>[timestamp],[uid],[user-name],[processName]</p>
<p>[timestamp],[uid],[user-name],[processName]</p>
<p>....</p>

O.Man
<p>I think you are going in the wrong direction. The question specifies using Falco tool so you need to edit the falco_rules.local.yaml file. THis has nothing to do with the Auditing policy. It could be something like this:</p>
<pre><code>- rule: spawned_process_in_container
  desc: A process was spawned in the container.
  condition: container.name = &quot;pod&quot; and evt.type = execve
  output: &quot;%evt.time,%user.uid,%user.name,%proc.name&quot;
  priority: ERROR
</code></pre>
<p>And when you try to run you can use the below command for running it 40 seconds</p>
<blockquote>
<p>falco -M 40 -r /etc/falco/falco_rules.local.yaml &gt; log.txt</p>
</blockquote>
<p>This will run the falco for 40 seconds with your given conditions and push the result in your desired format to log.txt file.</p>
<p><em>P.S: I know this is quite late to answer but someone else might benefit from this.</em></p>
