Silence missing event

pkg/cmd/flags/policy.go

@@ -320,25 +320,5 @@ func CreatePolicies(policyScopeMap PolicyScopeMap, policyEventsMap PolicyEventMa
 		}
 	}
 
-	if len(policies.Map()) == 0 {
-		// if nothing was set, let us consider it as a single default policy
-		eventFilter := eventFilter{
-			Equal:    []string{},
-			NotEqual: []string{},
-		}
-
-		var err error
-		newPolicy := policy.NewPolicy()
-		newPolicy.EventsToTrace, err = prepareEventsToTrace(eventFilter, eventsNameToID)
-		if err != nil {
-			return nil, err
-		}
-
-		err = policies.Add(newPolicy)
-		if err != nil {
-			return nil, err
-		}
-	}
-
 	return policies, nil
 }

pkg/ebpf/tracee.go

@@ -955,16 +955,38 @@ func (t *Tracee) checkUnavailableKSymbols(eventsState map[events.ID]events.Event
 // missing, it will cancel their event with informative error message.
 func (t *Tracee) validateKallsymsDependencies() {
 	unavKSymbols := t.checkUnavailableKSymbols(t.eventsState)
+	depsToCancel := make(map[events.ID]string)
 
 	// Cancel events with unavailable symbols dependencies
 	for eventToCancel, missingDepSyms := range unavKSymbols {
 		eventNameToCancel := events.Core.GetDefinitionByID(eventToCancel).GetName()
-		logger.Errorw(
+		logger.Debugw(
 			"Event canceled because of missing kernel symbol dependency",
 			"missing symbols", missingDepSyms, "event", eventNameToCancel,
 		)
 
 		delete(t.eventsState, eventToCancel)
+
+		// Find all events that depend on eventToCancel
+		for eventID := range t.eventsState {
+			depsIDs := events.Core.GetDefinitionByID(eventID).GetDependencies().GetIDs()
+			for _, depID := range depsIDs {
+				if depID == eventToCancel {
+					depsToCancel[eventID] = eventNameToCancel
+				}
+			}
+		}
+
+		// Cancel all events that require eventToCancel
+		for eventID, depEventName := range depsToCancel {
+			logger.Debugw(
+				"Event canceled because it depends on an previously canceled event",
+				"event", events.Core.GetDefinitionByID(eventID).GetName(),
+				"dependency", depEventName,
+			)
+
+			delete(t.eventsState, eventID)
+		}
 	}
 }