[geraldcombs]

You might try passing `--modern-bpf` to sysdig. It has traditionally captured syscalls using a kernel module, and it sounds like that's where your errors are coming from. Newer versions have added eBPF support, which doesn't require a kmod but you have to pass in the `--modern-bpf` flag.

[beaugunderson]

Absolutely nailed it, that worked! Thanks so much for the pointer.