elastic / elastic/quark

SOCK_CONN_ESTABLISHED should be ATTEMPTED, success should be an attribute

Open
#157 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
C
Stars
22
Forks
9
Avg merge
1d 2h
Merged PRs (30d)
13

Description

The bpf probes actually spit out a failed connection as SOCK_CONN_ESTABLISHED, it should be SOCK_CONN_ATTEMPTED, or SOCK_CONN_OPENED or whatever.

We should express if it was successful or not as a new member in the event.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.