Open bradfair opened 4 years ago
The program should be
--- a/originals/Ch08_FileSystems/scread.bt
+++ b/originals/Ch08_FileSystems/scread.bt
@@ -20,6 +20,6 @@
tracepoint:syscalls:sys_enter_read
{
$task = (struct task_struct *)curtask;
- $file = (struct file *)*($task->files->fdt->fd + args->fd);
+ $file = (struct file *)*($task->files->fdt->fd + args->fd*8);
@filename[str($file->f_path.dentry->d_name.name)] = count();
}
(I'm not sure if bpftrace changed the behavior. )
Just a quick note to mention that @mmisono's fix no longer works (as of bpftrace 0.9.4, kernel 5.4.0-77).
Having copied the source from this repo just to ensure I wasn't fat-fingering it, the output of scread appears as:
On bpftrace v0.9.2-247-g4fe9, built about 15 mins ago. Kernel 4.18.0-147.3.1.el8_1.x86_64 How might I approach troubleshooting this?