Andy Strohman

I have a theory about what's going on. In protobuf3, the default values are never included during serialization in order to be more compact. Maybe if you add `EmitUnpopulated: true,`...

> Yes, that does fix the missing status: 0 issue. However, it causes every event to include all null/empty fields (e.g., pod: null, docker: "", cap: null, ns: null, process_credentials:...

I'm trying to address this as a part of https://github.com/cilium/tetragon/pull/4327

Hi @tdaudi. Thanks for creating this issue and giving me you insights in #4327. It's great getting your feedback early. > In security_bprm_check the bprm.interpreter attribute is null, I think...

I think we need to treat the two issues that you described here independently. 1) tetragon does not raise an event: This is title of this issue and the first...

@olsajiri and @FedeDP I consider this a stopgap, that only fixes the override return functionality. But I don't think that this addresses a larger, underlying problem that affects the generic...

> how about instead of re-using action.ArgError that we use for kprobe override, we could add uint64 action.ArgUprobeError (or some better name) that we will use for uprobe override.. and...

> > how about something like this > > Yes, that addresses my concern. I also think that with that change, we don't need this one any more. So, if...

> Thank you for taking time to write this PR. I opened an issue for this few month ago, see #3728. Thanks for bringing this to my attention, and your...

I'm converting back to draft, as I just realized a problem with my approach. I need to think about tracepoints and usdt a bit more.