zwass
07/25/2022, 6:29 PMalessandrogario
07/26/2022, 11:26 AMtimestamp: 9119873753834 thread_id: 13561 process_id: 13561 uid: 0 gid: 0 cgroup_id: 22467 exit_code: 0 probe_error: 0 duration: 224574 cgroup_name: system.slice
execve(filename: /usr/lib/NetworkManager/dispatcher.d/20-chrony-onoffline, argv: { /usr/lib/NetworkManager/dispatcher.d/20-chrony-onoffline, podman0, down })
zwass
08/03/2022, 4:16 PMArtemis Tosini
08/03/2022, 4:27 PMalessandrogario
08/03/2022, 5:12 PMcmake -S . -B build -DCMAKE_TOOLCHAIN_FILE=cmake/toolchain.cmake -G Ninja -DCMAKE_BUILD_TYPE=Debug -DEBPFPUB_BUILD_EXAMPLES=true
4. To build and test, I am using: cmake --build build && sudo ./build/examples/execsnoop/execsnoop
Artemis Tosini
08/03/2022, 6:04 PMuser.slice
stuffalessandrogario
08/03/2022, 7:40 PMArtemis Tosini
08/04/2022, 2:21 PMalessandrogario
08/04/2022, 5:03 PMcgroups.subsys[0].cgroup.kn.parent.name
instead of
cgroups.subsys[0].cgroup.kn.name
timestamp: 375109372265 thread_id: 2705 process_id: 2705 uid: 0 gid: 0 cgroup_id: 8574 exit_code: 0 probe_error: 0 duration: 201273 cgroup_name: libpod-1aa46f32bbc6e946c757359f
execve(filename: /usr/bin/date, argv: { date })
Artemis Tosini
08/05/2022, 6:46 PMtimestamp: 433808650127 thread_id: 1994 process_id: 1994 uid: 0 gid: 0 cgroup_id: 4815 exit_code: 18446744073709551614 probe_error: 0 duration: 9875 cgroup_name:
execve(filename: /usr/local/sbin/gzip, argv: { gzip, -d })
alessandrogario
08/05/2022, 6:47 PMArtemis Tosini
08/05/2022, 6:47 PMalessandrogario
08/05/2022, 6:47 PMArtemis Tosini
08/05/2022, 6:51 PMalessandrogario
08/05/2022, 6:53 PMArtemis Tosini
08/05/2022, 7:11 PMalessandrogario
08/05/2022, 8:45 PMcat /proc/2002/cgroup
0::/machine.slice/libpod-e8b7ef8bd7f6f63ade2c862891ccf424ded27d35c20e536990285d79af7309a4.scope/container
cat 10401/cgroup
0::/system.slice/docker-6dfb8c85100710cf6ac7ac15f311cd37fea4e97b7e05251d120b855aa39ae84b.scope
Artemis Tosini
08/05/2022, 8:47 PMalessandrogario
08/05/2022, 8:47 PMArtemis Tosini
08/05/2022, 8:49 PMalessandrogario
08/05/2022, 9:01 PMtimestamp: 2834861341276 thread_id: 3305 process_id: 3305 uid: 0 gid: 0 cgroup_id: 8997 exit_code: 0 probe_error: 0 duration: 167751
cgroup_name: libpod-46e9fc7dd73d128e58f34561, container
execve(filename: /usr/bin/date, argv: { date })
timestamp: 56308112557 thread_id: 2617 process_id: 2617 uid: 0 gid: 0 cgroup_id: 8271 exit_code: 0 probe_error: 0 duration: 182578
cgroup_name: system.slice, docker-456ab67280a837f4f36514c8
execve(filename: /usr/bin/date, argv: { date })