How can I filter process name in bpftrace?
hello all,
i tried to run an bpftrace one-liner with the code from the execsnoop.bt :
sudo bpftrace -o output.txt -e 'BEGIN {printf("%-10s %-5s %s\n", "TIME(ms)", "PID", "ARGS"); } t:syscalls:sys_enter_exec* { printf("%-10u %-5d ", elapsed / 1e6, pid); join(args->argv); } interval:s:60 { exit(); }'
but im stuck to filter with the process name, i dont know how to make a filter with this one-liner.
i thought it was simple with /comm == "man"/ before right after the syscall tracepoint but that's not how its work.
Posted May 27, 2023, 1:27 PM UTC · edited
45