iovisor / iovisor/bcc

execsnoop stops working after resume from suspend (sleep)

Open
#2,935 10 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

`execsnoop` stops working after resume from suspend (sleep), that is, start `execsnoop`, then suspend system and resume, and `execsnoop` doesn't capture some newly started processes.

My OS is Archlinux.

**Steps to Reproduce:**
1. Install `bcc-git` `bcc-tools-git` `python-bcc-git` from AUR.
2. Run `sudo bcc execsnoop`. Here it successfully capture all started processes.
3. Don't kill the `execsnoop` process. Suspend system, and then resume.
4. Run some new programs, and check whether the previous `execsnoop` process can still captures it. Here `execsnoop` can't capture some newly started processes.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the `execsnoop` entry point and reproduce the report using `sudo bcc execsnoop` on Arch Linux. Suspend and resume the system, then launch new programs; done means `execsnoop` continues capturing all newly started processes after resume.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux, python
Domain
observability-sre, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.