---
title: Libscap
id: libscap
date: 2023-07-17
full_link: https://github.com/falcosecurity/libs
short_description: >
  Falco uses libscap to collect the events from the ring buffer before forwarding them up to libsinsp.
aka:
tags:
- architecture
---
libscap, aka library for System CAPture, is the library used by {{< glossary_tooltip text="Falco" term_id="falco" >}} to collect the events from the ring buffer before forwarding them up to {{< glossary_tooltip text="libsinsp" term_id="libsinsp" >}}.

<!--more-->
Ref: https://github.com/falcosecurity/libs
