Hello Brenden! I’m not sure if it counts as an agenda item, but I’m interested in recording process events using tracepoints, and I would like to know what are the best practices when attempting to do

Hello Song! I'm using sys_enter_execve/sys_exit_execve and sys_enter_execveat/sys_exit_execveat. Bound loops seem really useful! This is going to solve many of the issues I had. I don't have code I ca

Hello everyone, I'll start with some backstory first: I wrote my own BPF library to trace functions/syscalls and yesterday I noticed that I am sometimes receiving broken openat() tracepoint data. This

Hello Tristan, thanks for spending the time to check this out! One thing I forgot to mention is that I can verify with strace that the filename parameter is always present. I initially suspected that

Hello Tristan! That is the same path I found when debugging with strace! I think I also saw a missing comm string during my tests (with printk from BCC), but I would have to reproduce it again to be s

Hello everyone! I am experiencing some issues with the execveat tracepoints, and was wondering if others could reproduce it or help me understand what I am doing wrong. On Arch Linux (kernel 5.9.1, pe