search

sysflow-telemetry / sysflow

SysFlow documentation and issues tracker
Other
44 stars 10 forks source link

Script name appears in Exe args #105

Open dcarolloz opened 1 year ago

dcarolloz commented 1 year ago

Indicate project libsysflow

Describe the bug When executing a script, the script name appears in the Exe args field

To reproduce Steps to reproduce the behavior:

  1. Build and run sf-collector example
  2. Create and run a bash script from terminal

Expected behavior The script name should appear only in the Exe field (as done with binaries)

Environment (please complete the following information):

sf-collector example log

****************************************************************
Header: Exporter , IP , File name 
Process: PID 13246 Creation Time, 1688462767702306855, Exe /usr/bin/bash, Exe Args , User Name vagrant, Group Name vagrant, TTY 1
Proc Evt: TID 13246, OpFlags 1, Ret 14128
****************************************************************
****************************************************************
Header: Exporter , IP , File name 
Process: PID 14128 Creation Time, 1688462920057048358, Exe /usr/bin/bash, Exe Args , User Name vagrant, Group Name vagrant, TTY 1
Proc Evt: TID 14128, OpFlags 1, Ret 0
****************************************************************
****************************************************************
Header: Exporter , IP , File name 
Process: PID 14128 Creation Time, 1688462920057048358, Exe /home/vagrant/script.sh, Exe Args ./script.sh, User Name vagrant, Group Name vagrant, TTY 1
Proc Evt: TID 14128, OpFlags 2, Ret 0
****************************************************************
****************************************************************
Header: Exporter , IP , File name 
Process: PID 14128 Creation Time, 1688462920057048358, Exe /home/vagrant/script.sh, Exe Args ./script.sh, User Name vagrant, Group Name vagrant, TTY 1
File: Type 102, Path /etc/ld.so.cache
File Flow: TID 14128, OpFlags: 9344, OpenFlags 4097, FD 3
****************************************************************