iovisor / iovisor/bcc

execsnoop misses arguments randomly on arm64

Open
#3,343 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

While running execsnoop, and this shell script

```
while : ; do
ls -la /tmp
sleep 1
done
```

I get the following output from `execsnoop` :

```
PCOMM PID PPID RET ARGS
ls 7168 7125 0 /usr/bin/ls /tmp
sleep 7169 7125 0
ls 7170 7125 0 /usr/bin/ls --color=auto
sleep 7171 7125 0
ls 7172 7125 0 /usr/bin/ls --color=auto
sleep 7173 7125 0 /usr/bin/sleep
ls 7174 7125 0 /usr/bin/ls -la /tmp
sleep 7175 7125 0 /usr/bin/sleep 1
ls 7176 7125 0 /usr/bin/ls -la /tmp
sleep 7177 7125 0 1
```

Sometimes the arguments are catched properly, sometimes only some of them. It seems to be pretty random.
This is happening on arm64 only. I tested on both 5.11 and 5.8 kernels and on 2 different ARM hardwares.

Any idea on what is happening ?

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.