iovisor / iovisor/bcc

Missing process arg in execsnoop

Open
#3,953 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

Hi,

I am running on the following environment:
```
- Distributor ID : Ubuntu
- Description. : Ubuntu 20.04.3 LTS
- Release. : 20.04
- Codename. : focal
- Kernel version : 5.13.0-40-generic
```

I have the following simple scripts:
**`wrapper.sh`**
```
bash ./script.sh abc 123 xyz 456
```

**`script.sh`**
```
sleep 3
```

When I run start `execsnoop` by `sudo execsnoop-bpfcc -u 1000` and then run `./wrapper.sh`, I am getting the following example output:
```
bash 75282 75281 0 xyz
sleep 75283 75282 0 /usr/bin/sleep 3
```

As you can see, 1th (`abc`), 2nd (`123`) and 4th (`456`) arguments of `script.sh` passed by `wrapper.sh` are missing.

Also, the missing arguments are not the same for all executions. For example, the following output is from another execution:
```
bash 75581 75580 0 /usr/bin/bash 123 xyz 456
sleep 75582 75581 0 /usr/bin/sleep 3
```

This time, only 1th (`abc`) argument is missing.

What might the problem/case here?

Thanks in advance.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.