iovisor / iovisor/bcc

open snoop for 32 bit apps on 64 bit platforms

Open
#3,843 9 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
5d 13h
Merged PRs (30d)
3

Description

I want to extend opensnoop to capture 'open' syscalls from 32 bit applications running on a Linux 4.18 x86_64 system. If I use bpftrace with tracepoint:raw_syscalls:sys_enter, I don't see any relevant 32 bit compatible syscalls being picked up for the applications. Does BCC support 32 bit compatibility mode, and if so, are there examples or documentation available on how to capture these calls?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading the opensnoop implementation and the BCC handling for raw_syscalls on Linux x86_64, then reproduce the missing 32-bit syscall captures described in the issue. Determine whether compatibility mode is supported and identify the examples or documentation needed; done means the behavior and usage are clearly established.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
observability, operating-systems
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.