Payload of syscall_entry_execve

[Valentin Grigorev via lttng-dev <lttng-dev@lists.lttng.org>]

[-- Attachment #1.1: Type: text/plain, Size: 1198 bytes --]

Hello!

Currently, I'm developing a process monitor on the base of LTTng, and I
face the challenge of accessing command-line arguments passed to execve
syscall.
I'm using LTTng live session and Babeltrace 2 C API to analyze events in
online mode.

syscall_entry_execve event has 3 payload fields: filename, argv, and envp.
The first one is a normal C-string, the second and the third
semantically are `char *const *`,
but provided by LTTng as simple unsigned integers (the corresponding fields
in Babaltrace2 event payload have type BT_FIELD_CLASS_TYPE_UNSIGNED_INTEGER,
while I expect BT_FIELD_CLASS_TYPE_DYNAMIC_ARRAY). As far as I understand,
these integers are argv and envp pointers casted to uint64_t. But in the
majority of
cases, events produced by LTTng are analyzed by another process and often
even offline, so these pointers became completely unuseful.

Could you say, if there are some configuration parameters that enable to
pass argv and envp content in syscall_entry_execve payload? Or some other
ways to get this
information from LTTng.

P.S. I consider getting this information from /proc/pid/cmdline, but it is
not looking like a clean solution.

Best regards.
Valentin Grigorev

[-- Attachment #1.2: Type: text/html, Size: 1556 bytes --]

[-- Attachment #2: Type: text/plain, Size: 156 bytes --]

_______________________________________________
lttng-dev mailing list
lttng-dev@lists.lttng.org
https://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev