When Falco Runs Out of Metadata

user.uid, user.loginuid, and fd.name under absent metadata on Falco 0.44.1 — plus the reported 4294967295 and /<NA> forms (0.31.0–0.40.0)

When It Runs — Run Report #RR01 · Testing what infrastructure actually does.

Provider · Component: Falco · alert output field rendering when metadata is absent (user.uid, user.loginuid, user.name, fd.name)

Versions tested: Falco 0.44.1 (our lab, 2026-08-18 — modern_ebpf, standard Ubuntu 24.04 kernel). Publicly reported across 0.31.0 (2022) through 0.40.0 (2025) — quoted as reported, not re-measured.

Config profile: Default falco.yaml as shipped in the official 0.44.1 image, with json_output=true and one custom output rule (full text in §2).

Verified on: 2026-08-18 (desk sources re-checked; lab run on 0.44.1 the same day) — re-verification against the then-current release happens at publication.

Affects: Anyone consuming Falco alert fields as values — dashboards, filters, and correlation that treat an absent field as a real one.

TL;DR: On Falco 0.44.1 we observed absent metadata rendered in value-like forms — user.loginuid as -1 (the one documented substitution), fd.name as <NA>/null, and one alert carrying a real uid, -1, and null side by side — while the reported forms user.uid = 4294967295 and the path-shaped /<NA> (#1921, #2126, #3246) did not appear in our scenarios and stand on those reports.

Full report: https://whenitruns.substack.com/p/when-falco-runs-out-of-metadata

Reproduction repo: https://github.com/whenitruns/when-falco-runs-out-of-metadata