Start with positive levels to get the offending system calls in the system or audit log.
Add level "2" to enable a filter which blocks only specific system calls like fork and exec* instead of blocking everything unknown. It should be reliable with respect to changes in libraries, but it provides only a very limited protection.
Instead of a single test with enabled seccomp, rerun all other non-destructive and destructive tests for each seccomp level.
