if use "container.id" or "container.name" ，there is no feedback or output

[Nginx1]

• root@u1-cks-n2:~# lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 20.04.6 LTS Release: 20.04 Codename: focal

• root@u1-cks-n2:~# sysdig --version sysdig version 0.33.1

• i use "curl -s https://s3.amazonaws.com/download.draios.com/stable/install-sysdig | bash" install

• root@u1-cks-n2:~# crictl -r unix:///run/containerd/containerd.sock ps CONTAINER IMAGE CREATED STATE NAME ATTEMPT POD ID POD d72f575b77ef7 8c811b4aec35f 55 minutes ago Running nginx-deploy 0 0149104852398 nginx-deploy 608ead384df3f 39ac5829baded 23 hours ago Running redis 0 8cdb24ede7fc8 redis 644cbccfe6737 f5a6b296b8a29 23 hours ago Running products-service 0 9474ae9cb5f8f products-service 43b07a0a839b0 39ac5829baded 23 hours ago Running redis 0 b607dc910629e lamp-deployment-746b9c8d69-cjp8x a1fc40f09ff59 f5a6b296b8a29 23 hours ago Running nginx 0 acec6ae88370d workload1-cd577f779-tkkhz 20693b85bc071 f5a6b296b8a29 23 hours ago Running nginx 0 a8fa437b6a99d workload1-cd577f779-47jmz 91ea99deb3392 d4d0783ac0175 23 hours ago Running calico-kube-controllers 1 98965eb3d8813 calico-kube-controllers-56c9fcd99b-hx4s4 ba202ad702436 ead0a4a53df89 23 hours ago Running coredns 1 bd05201a12e92 coredns-65dcc469f7-lznxl 25c4106a154fa ead0a4a53df89 23 hours ago Running coredns 1 c42df5ccddab3 coredns-65dcc469f7-nxh7h 966e94ef4dc88 c595bc026ccfe 23 hours ago Running calico-node 1 0b4e6e058ec74 calico-node-f58rl 61d08c8fd8c88 9ce05acab8c4b 23 hours ago Running calico-typha 1 be0f9d9758a3b calico-typha-5d78c5fdd4-rwv7s 2641ab4f380cf 5f82fc39fa816 23 hours ago Running kube-proxy 1 67214447040fb kube-proxy-hkgw4

• root@u1-cks-n2:~# sysdig -M 5 -p "%evt.time,%user.uid,%proc.name" --cri /run/containerd/containerd.sock container.id=608ead384df3f root@u1-cks-n2:~# sysdig -M 5 -p "%evt.time,%user.uid,%proc.name" --cri /run/containerd/containerd.sock container.name=redis root@u1-cks-n2:~# sysdig -M 5 -p "%evt.time,%user.uid,%proc.name" --cri /run/containerd/containerd.sock container.id=61d08c8fd8c88 root@u1-cks-n2:~# sysdig -M 5 -p "%evt.time,%user.uid,%proc.name" --cri /run/containerd/containerd.sock container.id=2641ab4f380cf root@u1-cks-n2:~# sysdig -M 5 -p "%evt.time,%user.uid,%proc.name" --cri /run/containerd/containerd.sock container.id=kube-proxy-hkgw4

• root@u1-cks-n2:~# sysdig -M 1 -p "%evt.time,%user.uid,%proc.name" --cri /run/containerd/containerd.sock 16:54:38.818581449,0,sysdig 16:54:38.818620974,0,sysdig 16:54:38.818655915,0,sysdig 16:54:38.818697653,0,sysdig 16:54:38.818756614,0,sysdig 16:54:38.818775580,0,sysdig 16:54:38.818838606,0,sysdig 16:54:38.818857623,0,sysdig 16:54:38.818901004,0,sysdig 16:54:38.818941119,0,sysdig 16:54:38.819003671,0,sysdig 16:54:38.819016001,0,sysdig 16:54:38.819079584,0,sysdig 16:54:38.819090532,0,sysdig 16:54:38.819124172,0,sysdig 16:54:38.819143216,0,sysdig 16:54:38.819203607,0,sysdig 16:54:38.819214221,0,sysdig 16:54:38.819277429,0,sysdig 16:54:38.819296754,0,sysdig 16:54:38.819330720,0,sysdig 16:54:38.819355877,0,sysdig 16:54:38.819439035,0,sysdig 16:54:38.819451784,0,sysdig 16:54:38.819546491,0,sysdig 16:54:38.819566119,0,sysdig 16:54:38.819623725,0,sysdig 16:54:38.819642653,0,sysdig 16:54:38.819724115,0,sysdig 16:54:38.819743220,0,sysdig 16:54:38.819807223,0,sysdig 16:54:38.819819740,0,sysdig 16:54:38.819850481,0,sysdig

[therealbobo]

Hi @Nginx1! Could you try without the -M parameter?

[Nginx1]

Hi @Nginx1! Could you try without the -M parameter?

• sure，i try it,but it seems like there is still no output
• ` root@u1-cks-n2:~# crictl -r unix:///run/containerd/containerd.sock ps | grep proxy 2641ab4f380cf 5f82fc39fa816 45 hours ago Running kube-proxy 1 67214447040fb kube-proxy-hkgw4

root@u1-cks-n2:~# sysdig -p "%evt.time,%user.uid,%proc.name" --cri /run/containerd/containerd.sock container.name=kube-proxy-hkgw4

root@u1-cks-n2:~# sysdig -p "%evt.time,%user.uid,%proc.name" --cri /run/containerd/containerd.sock container.id=2641ab4f380cf`

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.