bug: char_buf matchArgs works not as expected #575

Y-dc · 2022-12-02T11:53:59Z

I created such a TracingPolicy:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: http
spec:
  tracepoints:
  - args:
    - index: 5
      returnCopy: false
      type: fd
    - index: 6
      returnCopy: false
      sizeArgIndex: 8
      type: char_buf
    - index: 7
      returnCopy: false
      type: size_t
    event: sys_enter_write
    selectors:
    - matchArgs:
      - index: 6
        operator: Prefix
        values:
        - HTTP
    subsystem: syscalls
  - args:
    - index: 5
      returnCopy: false
      type: fd
    - index: 6
      returnCopy: false
      sizeArgIndex: 8
      type: char_buf
    - index: 7
      returnCopy: false
      type: size_t
    event: sys_enter_read
    selectors:
    - {}
    subsystem: syscalls

i expected filter the events of tracepoint sys_enter_write, match char_buf prefix is "HTTP". but all events of sys_enter_write are filtered out.
example：
the TracingPolicy without selectors

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: http
spec:
  tracepoints:
  - args:
    - index: 5
      returnCopy: false
      type: fd
    - index: 6
      returnCopy: false
      sizeArgIndex: 8
      type: char_buf
    - index: 7
      returnCopy: false
      type: size_t
    event: sys_enter_write
    subsystem: syscalls
  - args:
    - index: 5
      returnCopy: false
      type: fd
    - index: 6
      returnCopy: false
      sizeArgIndex: 8
      type: char_buf
    - index: 7
      returnCopy: false
      type: size_t
    event: sys_enter_read
    subsystem: syscalls

logs added at:

// Notify implements Listener.Notify.
func (pm *ProcessManager) Notify(event notify.Message) error {
	processedEvent := event.HandleMessage()
	if processedEvent != nil {
		js, _ := json.Marshal(processedEvent)
		if strings.Contains(string(js),"/data/code/main") &&
			(strings.Contains(string(js), "sys_enter_read") ||
				strings.Contains(string(js), "sys_enter_write")){
			fmt.Printf("print events: %s\n",js)
		}
		pm.NotifyListener(event, processedEvent)
	}
	return nil
}

after i send a http request, logs:

time="2022-12-02T11:26:19Z" level=info msg="tracing policy added" policy="{[] [{syscalls sys_enter_write [{5 fd 0 false} {6 char_buf 8 false} {7 size_t 0 false}] []} {syscalls sys_enter_read [{5 fd 0 false} {6 char_buf 8 false} {7 size_t 0 false}] [{[] [] [] [] [] [] [] [] []}]}]}"
time="2022-12-02T11:26:19Z" level=info msg="BTF file: using metadata file" metadata=/sys/kernel/btf/vmlinux
time="2022-12-02T11:26:19Z" level=info msg="Loading sensor" name=gtp-sensor-5
time="2022-12-02T11:26:19Z" level=info msg="Loading kernel version 5.4.119"
time="2022-12-02T11:26:19Z" level=info msg="tetragon, map loaded." map=fdinstall_map path=/sys/fs/bpf/tetragon/gtp-sensor-5-gtp-0-fdinstall_map sensor=gtp-sensor-5
time="2022-12-02T11:26:19Z" level=info msg="tetragon, map loaded." map=tp_calls path=/sys/fs/bpf/tetragon/gtp-sensor-5-gtp-0-tp_calls sensor=gtp-sensor-5
time="2022-12-02T11:26:19Z" level=info msg="tetragon, map loaded." map=filter_map path=/sys/fs/bpf/tetragon/gtp-sensor-5-gtp-0-filter_map sensor=gtp-sensor-5
time="2022-12-02T11:26:19Z" level=info msg="tetragon, map loaded." map=argfilter_maps path=/sys/fs/bpf/tetragon/gtp-sensor-5-gtp-0-argfilter_maps sensor=gtp-sensor-5
time="2022-12-02T11:26:20Z" level=info msg="tetragon, map loaded." map=fdinstall_map path=/sys/fs/bpf/tetragon/gtp-sensor-5-gtp-1-fdinstall_map sensor=gtp-sensor-5
time="2022-12-02T11:26:20Z" level=info msg="tetragon, map loaded." map=tp_calls path=/sys/fs/bpf/tetragon/gtp-sensor-5-gtp-1-tp_calls sensor=gtp-sensor-5
time="2022-12-02T11:26:20Z" level=info msg="tetragon, map loaded." map=filter_map path=/sys/fs/bpf/tetragon/gtp-sensor-5-gtp-1-filter_map sensor=gtp-sensor-5
time="2022-12-02T11:26:20Z" level=info msg="tetragon, map loaded." map=argfilter_maps path=/sys/fs/bpf/tetragon/gtp-sensor-5-gtp-1-argfilter_maps sensor=gtp-sensor-5
time="2022-12-02T11:26:20Z" level=info msg="Loading registered BPF probe" Program=/var/lib/tetragon/bpf_generic_tracepoint_v53.o Type=generic_tracepoint
time="2022-12-02T11:26:25Z" level=info msg="Loading registered BPF probe" Program=/var/lib/tetragon/bpf_generic_tracepoint_v53.o Type=generic_tracepoint
time="2022-12-02T11:26:32Z" level=info msg="Loaded BPF maps and events for sensor successfully" sensor=gtp-sensor-5
print events: {"process_tracepoint":{"process":{"exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjExNDg1NDIzNDU3ODo2MjA=","pid":620,"uid":0,"cwd":"/data/code","binary":"/data/code/main","flags":"execve clone","start_time":"2022-12-02T11:27:08.164884979Z","auid":4294967295,"pod":{"namespace":"dctestpro","name":"tetragon-dev-v1-886f69fd4-lqfx7","container":{"id":"containerd://7dfd2996a4ecba47f3052ddeff1fc4f3c296b83fc72d7bcb9721376c326c7633","name":"tetragon-dev-v1","image":{"id":"odp-global.tencentcloudcr.com/dctestpro/tetragon@sha256:555bf0f336ecde2ba93cd6c74eb56bb2a019875f1f02dc2b2f63dff4247a96aa","name":"odp-global.tencentcloudcr.com/dctestpro/tetragon:v1.0.6"},"start_time":"2022-12-02T11:27:08Z","pid":8},"pod_labels":{"app":"tetragon-dev-v1","app-creator":"dechengyuan","app-env":"dev","app-id":"22502","devops-env":"release","env":"dev","k8s-app":"tetragon-dev-v1","node-type":"eks","paasid":"","paasname":"tetragon","pod-template-hash":"886f69fd4"}},"docker":"7dfd2996a4ecba47f3052ddeff1fc4f","parent_exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjExNDg0MTAzNzUwMDo2MDc=","refcnt":1},"parent":{"exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjExNDg0MTAzNzUwMDo2MDc=","pid":607,"uid":0,"cwd":"/data/code","binary":"/bin/bash","arguments":"-c /data/tmp/bd_dockerfile_cmdcommands.sh","flags":"execve clone","start_time":"2022-12-02T11:27:08.151687938Z","auid":4294967295,"pod":{"namespace":"dctestpro","name":"tetragon-dev-v1-886f69fd4-lqfx7","container":{"id":"containerd://7dfd2996a4ecba47f3052ddeff1fc4f3c296b83fc72d7bcb9721376c326c7633","name":"tetragon-dev-v1","image":{"id":"odp-global.tencentcloudcr.com/dctestpro/tetragon@sha256:555bf0f336ecde2ba93cd6c74eb56bb2a019875f1f02dc2b2f63dff4247a96aa","name":"odp-global.tencentcloudcr.com/dctestpro/tetragon:v1.0.6"},"start_time":"2022-12-02T11:27:08Z","pid":1},"pod_labels":{"app":"tetragon-dev-v1","app-creator":"dechengyuan","app-env":"dev","app-id":"22502","devops-env":"release","env":"dev","k8s-app":"tetragon-dev-v1","node-type":"eks","paasid":"","paasname":"tetragon","pod-template-hash":"886f69fd4"}},"docker":"7dfd2996a4ecba47f3052ddeff1fc4f","parent_exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjg1MzAwMDAwMDA6NDk4"},"subsys":"syscalls","event":"sys_enter_read","args":[{"size_arg":"7"},{"bytes_arg":"Q2hhckJ1ZkVycm9yUGFnZUZhdWx0"},{"size_arg":"4096"}]},"node_name":"eklet-subnet-bxgkfn1q","time":"2022-12-02T11:29:30.714468650Z"}
print events: {"process_tracepoint":{"process":{"exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjExNDg1NDIzNDU3ODo2MjA=","pid":620,"uid":0,"cwd":"/data/code","binary":"/data/code/main","flags":"execve clone","start_time":"2022-12-02T11:27:08.164884979Z","auid":4294967295,"pod":{"namespace":"dctestpro","name":"tetragon-dev-v1-886f69fd4-lqfx7","container":{"id":"containerd://7dfd2996a4ecba47f3052ddeff1fc4f3c296b83fc72d7bcb9721376c326c7633","name":"tetragon-dev-v1","image":{"id":"odp-global.tencentcloudcr.com/dctestpro/tetragon@sha256:555bf0f336ecde2ba93cd6c74eb56bb2a019875f1f02dc2b2f63dff4247a96aa","name":"odp-global.tencentcloudcr.com/dctestpro/tetragon:v1.0.6"},"start_time":"2022-12-02T11:27:08Z","pid":8},"pod_labels":{"app":"tetragon-dev-v1","app-creator":"dechengyuan","app-env":"dev","app-id":"22502","devops-env":"release","env":"dev","k8s-app":"tetragon-dev-v1","node-type":"eks","paasid":"","paasname":"tetragon","pod-template-hash":"886f69fd4"}},"docker":"7dfd2996a4ecba47f3052ddeff1fc4f","parent_exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjExNDg0MTAzNzUwMDo2MDc=","refcnt":1},"parent":{"exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjExNDg0MTAzNzUwMDo2MDc=","pid":607,"uid":0,"cwd":"/data/code","binary":"/bin/bash","arguments":"-c /data/tmp/bd_dockerfile_cmdcommands.sh","flags":"execve clone","start_time":"2022-12-02T11:27:08.151687938Z","auid":4294967295,"pod":{"namespace":"dctestpro","name":"tetragon-dev-v1-886f69fd4-lqfx7","container":{"id":"containerd://7dfd2996a4ecba47f3052ddeff1fc4f3c296b83fc72d7bcb9721376c326c7633","name":"tetragon-dev-v1","image":{"id":"odp-global.tencentcloudcr.com/dctestpro/tetragon@sha256:555bf0f336ecde2ba93cd6c74eb56bb2a019875f1f02dc2b2f63dff4247a96aa","name":"odp-global.tencentcloudcr.com/dctestpro/tetragon:v1.0.6"},"start_time":"2022-12-02T11:27:08Z","pid":1},"pod_labels":{"app":"tetragon-dev-v1","app-creator":"dechengyuan","app-env":"dev","app-id":"22502","devops-env":"release","env":"dev","k8s-app":"tetragon-dev-v1","node-type":"eks","paasid":"","paasname":"tetragon","pod-template-hash":"886f69fd4"}},"docker":"7dfd2996a4ecba47f3052ddeff1fc4f","parent_exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjg1MzAwMDAwMDA6NDk4"},"subsys":"syscalls","event":"sys_enter_write","args":[{"size_arg":"7"},{"bytes_arg":"SFRUUC8xLjEgMjAwIE9LDQpDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL2pzb247IGNoYXJzZXQ9dXRmLTgNCkRhdGU6IEZyaSwgMDIgRGVjIDIwMjIgMTE6Mjk6MzAgR01UDQpDb250ZW50LUxlbmd0aDogMzENCg0KeyJjb2RlIjoiMCIsIm1lc3NhZ2UiOiJIZWxsbyEifQ=="},{"size_arg":"154"}]},"node_name":"eklet-subnet-bxgkfn1q","time":"2022-12-02T11:29:30.714662232Z"}
print events: {"process_tracepoint":{"process":{"exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjExNDg1NDIzNDU3ODo2MjA=","pid":620,"uid":0,"cwd":"/data/code","binary":"/data/code/main","flags":"execve clone","start_time":"2022-12-02T11:27:08.164884979Z","auid":4294967295,"pod":{"namespace":"dctestpro","name":"tetragon-dev-v1-886f69fd4-lqfx7","container":{"id":"containerd://7dfd2996a4ecba47f3052ddeff1fc4f3c296b83fc72d7bcb9721376c326c7633","name":"tetragon-dev-v1","image":{"id":"odp-global.tencentcloudcr.com/dctestpro/tetragon@sha256:555bf0f336ecde2ba93cd6c74eb56bb2a019875f1f02dc2b2f63dff4247a96aa","name":"odp-global.tencentcloudcr.com/dctestpro/tetragon:v1.0.6"},"start_time":"2022-12-02T11:27:08Z","pid":8},"pod_labels":{"app":"tetragon-dev-v1","app-creator":"dechengyuan","app-env":"dev","app-id":"22502","devops-env":"release","env":"dev","k8s-app":"tetragon-dev-v1","node-type":"eks","paasid":"","paasname":"tetragon","pod-template-hash":"886f69fd4"}},"docker":"7dfd2996a4ecba47f3052ddeff1fc4f","parent_exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjExNDg0MTAzNzUwMDo2MDc=","refcnt":1},"parent":{"exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjExNDg0MTAzNzUwMDo2MDc=","pid":607,"uid":0,"cwd":"/data/code","binary":"/bin/bash","arguments":"-c /data/tmp/bd_dockerfile_cmdcommands.sh","flags":"execve clone","start_time":"2022-12-02T11:27:08.151687938Z","auid":4294967295,"pod":{"namespace":"dctestpro","name":"tetragon-dev-v1-886f69fd4-lqfx7","container":{"id":"containerd://7dfd2996a4ecba47f3052ddeff1fc4f3c296b83fc72d7bcb9721376c326c7633","name":"tetragon-dev-v1","image":{"id":"odp-global.tencentcloudcr.com/dctestpro/tetragon@sha256:555bf0f336ecde2ba93cd6c74eb56bb2a019875f1f02dc2b2f63dff4247a96aa","name":"odp-global.tencentcloudcr.com/dctestpro/tetragon:v1.0.6"},"start_time":"2022-12-02T11:27:08Z","pid":1},"pod_labels":{"app":"tetragon-dev-v1","app-creator":"dechengyuan","app-env":"dev","app-id":"22502","devops-env":"release","env":"dev","k8s-app":"tetragon-dev-v1","node-type":"eks","paasid":"","paasname":"tetragon","pod-template-hash":"886f69fd4"}},"docker":"7dfd2996a4ecba47f3052ddeff1fc4f","parent_exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjg1MzAwMDAwMDA6NDk4"},"subsys":"syscalls","event":"sys_enter_read","args":[{"size_arg":"7"},{"bytes_arg":"R0VUIC9oZWxsbyBIVFRQLzEuMQ0KSG9zdDogZGN0ZXN0cHJvLnRldHJhZ29uLm9kcGNsZGV2LndvYS5jb20NCkNhY2hlLUNvbnRyb2w6IG1heC1hZ2U9MA0KVXBncmFkZS1JbnNlY3VyZS1SZXF1ZXN0czogMQ0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTVfNykgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwNy4wLjAuMCBTYWZhcmkvNTM3LjM2DQpBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL2F2aWYsaW1hZ2Uvd2VicCxpbWFnZS9hcG5nLCovKjtxPTAuOCxhcHBsaWNhdGlvbi9zaWduZWQtZXhjaGFuZ2U7dj1iMztxPTAuOQ0KQWNjZXB0LUxhbmd1YWdlOiB6aC1DTix6aDtxPTAuOQ0KQ29va2llOiB4LWhvc3Qta2V5LWlkY2JhY2s9NDU4Y2E5OTIyY2NmODk5ZGMwODIxNmY2MjljYTJlMWUxZDQ5MWI3Ml9zOyB4LWhvc3Qta2V5LW9hYmFjaz00NThjYTk5MjJjY2Y4OTlkYzA4MjE2ZjYyOWNhMmUxZTFkNDkxYjcyX3M7IHgtaG9zdC1rZXktZnJvbnQ9NDU4Y2E5OTIyY2NmODk5ZGMwODIxNmY2MjljYTJlMWUxZDQ5MWI3Ml9zOyB4X2hvc3Rfa2V5PTQ1OGNhOTkyMmNjZjg5OWRjMDgyMTZmNjI5Y2EyZTFlMWQ0OTFiNzJfczsgeC1ob3N0LWtleS1uZ249NDU4Y2E5OTIyY2NmODk5ZGMwODIxNmY2MjljYTJlMWUxZDQ5MWI3Ml9zOyB4LXRvZmFwaS1ob3N0LWtleT0xN2U1MWIyY2Q3Yy04ZGRmMDNmYjYwZTcyNTUxYjFlZWFkM2NkZDgwNzQ2OTRkNTc1ODJkOyBEaWdnZXJUcmFjZUlkPTJkMDgxNjMwLTc4MGYtMTFlYy1hODBkLTk1ZWZlZjAyOGM1YjsgeF9ob3N0X2tleV9hY2Nlc3M9NDU4Y2E5OTIyY2NmODk5ZGMwODIxNmY2MjljYTJlMWUxZDQ5MWI3Ml9zOyB4LWltcC1ob3N0LWtleT0xN2U5YTNkOWYyOC1hMzI2YzkyYmVmNWRhMjI1MGI2ZDIyMjU5ZDgyN2EwMGJkNzZlMmJlOyB0X3VpZD1kZWNoZW5neXVhbjsgYmx1ZWtpbmdfbGFu"},{"size_arg":"4096"}]},"node_name":"eklet-subnet-bxgkfn1q","time":"2022-12-02T11:29:30.714733452Z"}

sys_enter_write char_buf :

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Date: Fri, 02 Dec 2022 11:29:30 GMT
Content-Length: 31

{"code":"0","message":"Hello!"}

after i add the selectors in, logs:

time="2022-12-02T11:43:48Z" level=info msg="tracing policy added" policy="{[] [{syscalls sys_enter_write [{5 fd 0 false} {6 char_buf 8 false} {7 size_t 0 false}] [{[] [{6 Prefix [HTTP]}] [] [] [] [] [] [] []}]} {syscalls sys_enter_read [{5 fd 0 false} {6 char_buf 8 false} {7 size_t 0 false}] [{[] [] [] [] [] [] [] [] []}]}]}"
time="2022-12-02T11:43:48Z" level=info msg="BTF file: using metadata file" metadata=/sys/kernel/btf/vmlinux
time="2022-12-02T11:43:48Z" level=info msg="Loading sensor" name=gtp-sensor-6
time="2022-12-02T11:43:48Z" level=info msg="Loading kernel version 5.4.119"
time="2022-12-02T11:43:48Z" level=info msg="tetragon, map loaded." map=fdinstall_map path=/sys/fs/bpf/tetragon/gtp-sensor-6-gtp-0-fdinstall_map sensor=gtp-sensor-6
time="2022-12-02T11:43:48Z" level=info msg="tetragon, map loaded." map=tp_calls path=/sys/fs/bpf/tetragon/gtp-sensor-6-gtp-0-tp_calls sensor=gtp-sensor-6
time="2022-12-02T11:43:48Z" level=info msg="tetragon, map loaded." map=filter_map path=/sys/fs/bpf/tetragon/gtp-sensor-6-gtp-0-filter_map sensor=gtp-sensor-6
time="2022-12-02T11:43:48Z" level=info msg="tetragon, map loaded." map=argfilter_maps path=/sys/fs/bpf/tetragon/gtp-sensor-6-gtp-0-argfilter_maps sensor=gtp-sensor-6
time="2022-12-02T11:43:48Z" level=info msg="tetragon, map loaded." map=fdinstall_map path=/sys/fs/bpf/tetragon/gtp-sensor-6-gtp-1-fdinstall_map sensor=gtp-sensor-6
time="2022-12-02T11:43:48Z" level=info msg="tetragon, map loaded." map=tp_calls path=/sys/fs/bpf/tetragon/gtp-sensor-6-gtp-1-tp_calls sensor=gtp-sensor-6
time="2022-12-02T11:43:48Z" level=info msg="tetragon, map loaded." map=filter_map path=/sys/fs/bpf/tetragon/gtp-sensor-6-gtp-1-filter_map sensor=gtp-sensor-6
time="2022-12-02T11:43:48Z" level=info msg="tetragon, map loaded." map=argfilter_maps path=/sys/fs/bpf/tetragon/gtp-sensor-6-gtp-1-argfilter_maps sensor=gtp-sensor-6
time="2022-12-02T11:43:48Z" level=info msg="Loading registered BPF probe" Program=/var/lib/tetragon/bpf_generic_tracepoint_v53.o Type=generic_tracepoint
time="2022-12-02T11:43:51Z" level=info msg="Loading registered BPF probe" Program=/var/lib/tetragon/bpf_generic_tracepoint_v53.o Type=generic_tracepoint
time="2022-12-02T11:43:55Z" level=info msg="Loaded BPF maps and events for sensor successfully" sensor=gtp-sensor-6
print events: {"process_tracepoint":{"process":{"exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjg5NDAwMDAwMDA6NTY3","pid":567,"uid":0,"cwd":"/data/code","binary":"/data/code/main","flags":"procFS auid","start_time":"2022-12-02T11:43:25.546661009Z","auid":4294967295,"pod":{"namespace":"dctestpro","name":"tetragon-dev-v1-6f8b5fcfcd-c4dzd","container":{"id":"containerd://f71dd550bc6a99ad046a38bdd0be58348cd418295bce5356ffd1851defdab4f4","name":"tetragon-dev-v1","image":{"id":"odp-global.tencentcloudcr.com/dctestpro/tetragon@sha256:555bf0f336ecde2ba93cd6c74eb56bb2a019875f1f02dc2b2f63dff4247a96aa","name":"odp-global.tencentcloudcr.com/dctestpro/tetragon:v1.0.6"},"start_time":"2022-12-02T11:43:25Z","pid":7},"pod_labels":{"app":"tetragon-dev-v1","app-creator":"dechengyuan","app-env":"dev","app-id":"22502","devops-env":"release","env":"dev","k8s-app":"tetragon-dev-v1","node-type":"eks","paasid":"","paasname":"tetragon","pod-template-hash":"6f8b5fcfcd"}},"docker":"f71dd550bc6a99ad046a38bdd0be583","parent_exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjg3NjAwMDAwMDA6NTU0","refcnt":1},"parent":{"exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjg3NjAwMDAwMDA6NTU0","pid":554,"uid":0,"cwd":"/data/code","binary":"/usr/bin/bash","arguments":"-c /data/tmp/bd_dockerfile_cmdcommands.sh","flags":"procFS auid","start_time":"2022-12-02T11:43:25.366661344Z","auid":4294967295,"pod":{"namespace":"dctestpro","name":"tetragon-dev-v1-6f8b5fcfcd-c4dzd","container":{"id":"containerd://f71dd550bc6a99ad046a38bdd0be58348cd418295bce5356ffd1851defdab4f4","name":"tetragon-dev-v1","image":{"id":"odp-global.tencentcloudcr.com/dctestpro/tetragon@sha256:555bf0f336ecde2ba93cd6c74eb56bb2a019875f1f02dc2b2f63dff4247a96aa","name":"odp-global.tencentcloudcr.com/dctestpro/tetragon:v1.0.6"},"start_time":"2022-12-02T11:43:25Z","pid":1},"pod_labels":{"app":"tetragon-dev-v1","app-creator":"dechengyuan","app-env":"dev","app-id":"22502","devops-env":"release","env":"dev","k8s-app":"tetragon-dev-v1","node-type":"eks","paasid":"","paasname":"tetragon","pod-template-hash":"6f8b5fcfcd"}},"docker":"f71dd550bc6a99ad046a38bdd0be583","parent_exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjc1MzAwMDAwMDA6NDY0"},"subsys":"syscalls","event":"sys_enter_read","args":[{"size_arg":"7"},{"bytes_arg":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"},{"size_arg":"4096"}]},"node_name":"eklet-subnet-bxgkfn1q","time":"2022-12-02T11:44:20.665990376Z"}
print events: {"process_tracepoint":{"process":{"exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjg5NDAwMDAwMDA6NTY3","pid":567,"uid":0,"cwd":"/data/code","binary":"/data/code/main","flags":"procFS auid","start_time":"2022-12-02T11:43:25.546661009Z","auid":4294967295,"pod":{"namespace":"dctestpro","name":"tetragon-dev-v1-6f8b5fcfcd-c4dzd","container":{"id":"containerd://f71dd550bc6a99ad046a38bdd0be58348cd418295bce5356ffd1851defdab4f4","name":"tetragon-dev-v1","image":{"id":"odp-global.tencentcloudcr.com/dctestpro/tetragon@sha256:555bf0f336ecde2ba93cd6c74eb56bb2a019875f1f02dc2b2f63dff4247a96aa","name":"odp-global.tencentcloudcr.com/dctestpro/tetragon:v1.0.6"},"start_time":"2022-12-02T11:43:25Z","pid":7},"pod_labels":{"app":"tetragon-dev-v1","app-creator":"dechengyuan","app-env":"dev","app-id":"22502","devops-env":"release","env":"dev","k8s-app":"tetragon-dev-v1","node-type":"eks","paasid":"","paasname":"tetragon","pod-template-hash":"6f8b5fcfcd"}},"docker":"f71dd550bc6a99ad046a38bdd0be583","parent_exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjg3NjAwMDAwMDA6NTU0","refcnt":1},"parent":{"exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjg3NjAwMDAwMDA6NTU0","pid":554,"uid":0,"cwd":"/data/code","binary":"/usr/bin/bash","arguments":"-c /data/tmp/bd_dockerfile_cmdcommands.sh","flags":"procFS auid","start_time":"2022-12-02T11:43:25.366661344Z","auid":4294967295,"pod":{"namespace":"dctestpro","name":"tetragon-dev-v1-6f8b5fcfcd-c4dzd","container":{"id":"containerd://f71dd550bc6a99ad046a38bdd0be58348cd418295bce5356ffd1851defdab4f4","name":"tetragon-dev-v1","image":{"id":"odp-global.tencentcloudcr.com/dctestpro/tetragon@sha256:555bf0f336ecde2ba93cd6c74eb56bb2a019875f1f02dc2b2f63dff4247a96aa","name":"odp-global.tencentcloudcr.com/dctestpro/tetragon:v1.0.6"},"start_time":"2022-12-02T11:43:25Z","pid":1},"pod_labels":{"app":"tetragon-dev-v1","app-creator":"dechengyuan","app-env":"dev","app-id":"22502","devops-env":"release","env":"dev","k8s-app":"tetragon-dev-v1","node-type":"eks","paasid":"","paasname":"tetragon","pod-template-hash":"6f8b5fcfcd"}},"docker":"f71dd550bc6a99ad046a38bdd0be583","parent_exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjc1MzAwMDAwMDA6NDY0"},"subsys":"syscalls","event":"sys_enter_read","args":[{"size_arg":"7"},{"bytes_arg":"R0VUIC9oZWxsbyBIVFRQLzEuMQ0KSG9zdDogZGN0ZXN0cHJvLnRldHJhZ29uLm9kcGNsZGV2LndvYS5jb20NCkNhY2hlLUNvbnRyb2w6IG1heC1hZ2U9MA0KVXBncmFkZS1JbnNlY3VyZS1SZXF1ZXN0czogMQ0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTVfNykgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwNy4wLjAuMCBTYWZhcmkvNTM3LjM2DQpBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL2F2aWYsaW1hZ2Uvd2VicCxpbWFnZS9hcG5nLCovKjtxPTAuOCxhcHBsaWNhdGlvbi9zaWduZWQtZXhjaGFuZ2U7dj1iMztxPTAuOQ0KQWNjZXB0LUxhbmd1YWdlOiB6aC1DTix6aDtxPTAuOQ0KQ29va2llOiB4LWhvc3Qta2V5LWlkY2JhY2s9NDU4Y2E5OTIyY2NmODk5ZGMwODIxNmY2MjljYTJlMWUxZDQ5MWI3Ml9zOyB4LWhvc3Qta2V5LW9hYmFjaz00NThjYTk5MjJjY2Y4OTlkYzA4MjE2ZjYyOWNhMmUxZTFkNDkxYjcyX3M7IHgtaG9zdC1rZXktZnJvbnQ9NDU4Y2E5OTIyY2NmODk5ZGMwODIxNmY2MjljYTJlMWUxZDQ5MWI3Ml9zOyB4X2hvc3Rfa2V5PTQ1OGNhOTkyMmNjZjg5OWRjMDgyMTZmNjI5Y2EyZTFlMWQ0OTFiNzJfczsgeC1ob3N0LWtleS1uZ249NDU4Y2E5OTIyY2NmODk5ZGMwODIxNmY2MjljYTJlMWUxZDQ5MWI3Ml9zOyB4LXRvZmFwaS1ob3N0LWtleT0xN2U1MWIyY2Q3Yy04ZGRmMDNmYjYwZTcyNTUxYjFlZWFkM2NkZDgwNzQ2OTRkNTc1ODJkOyBEaWdnZXJUcmFjZUlkPTJkMDgxNjMwLTc4MGYtMTFlYy1hODBkLTk1ZWZlZjAyOGM1YjsgeF9ob3N0X2tleV9hY2Nlc3M9NDU4Y2E5OTIyY2NmODk5ZGMwODIxNmY2MjljYTJlMWUxZDQ5MWI3Ml9zOyB4LWltcC1ob3N0LWtleT0xN2U5YTNkOWYyOC1hMzI2YzkyYmVmNWRhMjI1MGI2ZDIyMjU5ZDgyN2EwMGJkNzZlMmJlOyB0X3VpZD1kZWNoZW5neXVhbjsgYmx1ZWtpbmdfbGFu"},{"size_arg":"4096"}]},"node_name":"eklet-subnet-bxgkfn1q","time":"2022-12-02T11:44:20.666174440Z"}
print events: {"process_tracepoint":{"process":{"exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjg5NDAwMDAwMDA6NTY3","pid":567,"uid":0,"cwd":"/data/code","binary":"/data/code/main","flags":"procFS auid","start_time":"2022-12-02T11:43:25.546661009Z","auid":4294967295,"pod":{"namespace":"dctestpro","name":"tetragon-dev-v1-6f8b5fcfcd-c4dzd","container":{"id":"containerd://f71dd550bc6a99ad046a38bdd0be58348cd418295bce5356ffd1851defdab4f4","name":"tetragon-dev-v1","image":{"id":"odp-global.tencentcloudcr.com/dctestpro/tetragon@sha256:555bf0f336ecde2ba93cd6c74eb56bb2a019875f1f02dc2b2f63dff4247a96aa","name":"odp-global.tencentcloudcr.com/dctestpro/tetragon:v1.0.6"},"start_time":"2022-12-02T11:43:25Z","pid":7},"pod_labels":{"app":"tetragon-dev-v1","app-creator":"dechengyuan","app-env":"dev","app-id":"22502","devops-env":"release","env":"dev","k8s-app":"tetragon-dev-v1","node-type":"eks","paasid":"","paasname":"tetragon","pod-template-hash":"6f8b5fcfcd"}},"docker":"f71dd550bc6a99ad046a38bdd0be583","parent_exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjg3NjAwMDAwMDA6NTU0","refcnt":1},"parent":{"exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjg3NjAwMDAwMDA6NTU0","pid":554,"uid":0,"cwd":"/data/code","binary":"/usr/bin/bash","arguments":"-c /data/tmp/bd_dockerfile_cmdcommands.sh","flags":"procFS auid","start_time":"2022-12-02T11:43:25.366661344Z","auid":4294967295,"pod":{"namespace":"dctestpro","name":"tetragon-dev-v1-6f8b5fcfcd-c4dzd","container":{"id":"containerd://f71dd550bc6a99ad046a38bdd0be58348cd418295bce5356ffd1851defdab4f4","name":"tetragon-dev-v1","image":{"id":"odp-global.tencentcloudcr.com/dctestpro/tetragon@sha256:555bf0f336ecde2ba93cd6c74eb56bb2a019875f1f02dc2b2f63dff4247a96aa","name":"odp-global.tencentcloudcr.com/dctestpro/tetragon:v1.0.6"},"start_time":"2022-12-02T11:43:25Z","pid":1},"pod_labels":{"app":"tetragon-dev-v1","app-creator":"dechengyuan","app-env":"dev","app-id":"22502","devops-env":"release","env":"dev","k8s-app":"tetragon-dev-v1","node-type":"eks","paasid":"","paasname":"tetragon","pod-template-hash":"6f8b5fcfcd"}},"docker":"f71dd550bc6a99ad046a38bdd0be583","parent_exec_id":"ZWtsZXQtc3VibmV0LWJ4Z2tmbjFxOjc1MzAwMDAwMDA6NDY0"},"subsys":"syscalls","event":"sys_enter_read","args":[{"size_arg":"5"},{"bytes_arg":"AAAAAAAAAAAAAAAAAAAAAA=="},{"size_arg":"16"}]},"node_name":"eklet-subnet-bxgkfn1q","time":"2022-12-02T11:44:20.665948726Z"}

the sys_enter_write event whose char_buff prefix is HTTP is filtered out instead.

The text was updated successfully, but these errors were encountered:

Y-dc · 2022-12-02T13:04:31Z

fixup #576

kkourt · 2023-04-27T10:02:57Z

closing, as it was fixed by #770

Y-dc mentioned this issue Dec 2, 2022

tetragon: char_buf matchArgs works not as expected #576

Closed

kkourt closed this as completed Apr 27, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

bug: char_buf matchArgs works not as expected #575

bug: char_buf matchArgs works not as expected #575

Y-dc commented Dec 2, 2022 •

edited

Loading

Y-dc commented Dec 2, 2022

kkourt commented Apr 27, 2023

bug: char_buf matchArgs works not as expected #575

bug: char_buf matchArgs works not as expected #575

Comments

Y-dc commented Dec 2, 2022 • edited Loading

Y-dc commented Dec 2, 2022

kkourt commented Apr 27, 2023

Y-dc commented Dec 2, 2022 •

edited

Loading