Use --modern-bpf as a fallback when /dev/scap0 does not exist?

[Apteryks]

Hello,

I've built sysdig with falcosecurity-libs that were built with the eBPF support only (modern BPF). I did not build the kernel driver. I find it strange/inconvenient that I need to remember to use sysdig --modern-bpf every time I use it. Sure, I could define a local alias for it, but that's a boot user experience in my opinion. Perhaps sysdig could automatically detect/use modern-bpf when the probe type was not specified?

Thank you!