Missing process arg in execsnoop
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
Hi,
I am running on the following environment:
```
- Distributor ID : Ubuntu
- Description. : Ubuntu 20.04.3 LTS
- Release. : 20.04
- Codename. : focal
- Kernel version : 5.13.0-40-generic
```
I have the following simple scripts:
**`wrapper.sh`**
```
bash ./script.sh abc 123 xyz 456
```
**`script.sh`**
```
sleep 3
```
When I run start `execsnoop` by `sudo execsnoop-bpfcc -u 1000` and then run `./wrapper.sh`, I am getting the following example output:
```
bash 75282 75281 0 xyz
sleep 75283 75282 0 /usr/bin/sleep 3
```
As you can see, 1th (`abc`), 2nd (`123`) and 4th (`456`) arguments of `script.sh` passed by `wrapper.sh` are missing.
Also, the missing arguments are not the same for all executions. For example, the following output is from another execution:
```
bash 75581 75580 0 /usr/bin/bash 123 xyz 456
sleep 75582 75581 0 /usr/bin/sleep 3
```
This time, only 1th (`abc`) argument is missing.
What might the problem/case here?
Thanks in advance.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.