r/eBPF•
NutsFbsd

How can I filter process name in bpftrace?

hello all,

i tried to run an bpftrace one-liner with the code from the execsnoop.bt :

sudo bpftrace -o output.txt -e 'BEGIN {printf("%-10s %-5s %s\n", "TIME(ms)", "PID", "ARGS"); } t:syscalls:sys_enter_exec* { printf("%-10u %-5d ", elapsed / 1e6, pid); join(args->argv); } interval:s:60 { exit(); }'

but im stuck to filter with the process name, i dont know how to make a filter with this one-liner.

i thought it was simple with /comm == "man"/ before right after the syscall tracepoint but that's not how its work.

Posted May 27, 2023, 1:27 PM UTC · edited

45
Loading comments…