search

draios / sysdig

Linux system exploration and troubleshooting tool with first class support for containers
http://www.sysdig.com/
Other
7.78k stars 725 forks source link

Incoherencies between trace file and live output when execve is filtered out #115

Open gianlucaborello opened 10 years ago

gianlucaborello commented 10 years ago

If the execve/clone for a process is filtered out, and the instrumented process is started when sysdig is already running, then the output on screen will not be coherent with the content of the dump file.

1) Despite the filter, output on screen is shown correctly:

$ sudo sysdig proc.name=ls and evt.type=openat
2612 20:44:02.098120967 3 ls (58315) > openat dirfd=-100(ENETDOWN) name=. flags=1089 mode=0
2613 20:44:02.098123141 3 ls (58315) < openat fd=3(<f>/home/gianluca)
...
$

2) Same as 1), but the trace is now saved

$ sudo sysdig -w dump.scap proc.name=ls and evt.type=openat
$

3) A user would expect the same output as 1), but instead a bunch of NA are shown

$ sysdig -r dump.scap
1 20:44:22.779774434 1 <NA> (58318) > openat dirfd=-100(ENETDOWN) name=. flags=1089 mode=0
2 20:44:22.779776464 1 <NA> (58318) < openat fd=3(<f>)
$
github-actions[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.