execsnoop stops working after resume from suspend (sleep)
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
`execsnoop` stops working after resume from suspend (sleep), that is, start `execsnoop`, then suspend system and resume, and `execsnoop` doesn't capture some newly started processes.
My OS is Archlinux.
**Steps to Reproduce:**
1. Install `bcc-git` `bcc-tools-git` `python-bcc-git` from AUR.
2. Run `sudo bcc execsnoop`. Here it successfully capture all started processes.
3. Don't kill the `execsnoop` process. Suspend system, and then resume.
4. Run some new programs, and check whether the previous `execsnoop` process can still captures it. Here `execsnoop` can't capture some newly started processes.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the `execsnoop` entry point and reproduce the report using `sudo bcc execsnoop` on Arch Linux. Suspend and resume the system, then launch new programs; done means `execsnoop` continues capturing all newly started processes after resume.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux, python
- Domain
- observability-sre, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100