Are the pids returned by `bpf process|socket events` the glo

Question

Are the pids returned by `bpf process|socket events` the global pid or in container pid

alessandrogario · Answer

They are global PIDs from the host perspective

alessandrogario · Answer

Compared to audit I ve implemented something that translates the return value for fork vfork clone to the host PID

zwass · Answer

Nice