bpftrace
bpftrace copied to clipboard
Strange characters in output
What reproduces the bug? Provide code if possible.
bpftrace -e 'tracepoint:sched:sched_process_exec { time("%H:%M:%S"); printf(" uid = %d pid = %d ppid = %d cmd = %s \n", uid, pid, curtask->parent->pid, comm); } tracepoint:syscalls:sys_enter_execve { time("%H:%M:%S"); printf(" uid = %d pid = %d ppid = %d cmd_with_args = ", uid, pid, curtask->parent->pid); join(args->argv); }'
bpftrace --info output
System
OS: Linux 6.17.9-arch1-1 #1 SMP PREEMPT_DYNAMIC Mon, 24 Nov 2025 15:21:09 +0000
Arch: x86_64
Build
version: v0.24.1
LLVM: 21.1.3
bfd: yes
libdw (DWARF support): yes
libsystemd (systemd notify support): yes
blazesym (advanced symbolization): no
Kernel helpers
probe_read_user: yes probe_read_user_str: yes
probe_read_kernel: yes probe_read_kernel_str: yes
send_signal: yes get_boot_ns: yes
dpath: yes skboutput: yes
get_tai_ns: yes get_func_ip: yes
jiffies64: yes for_each_map_elem: yes
get_ns_current_pid_tgid: yes lookup_percpu_elem: yes
Kernel features
Instruction limit: 1000000 btf: yes
module btf: yes map batch: yes
Map types
hash: yes array: yes
percpu array: yes stack_trace: yes
ringbuf: yes
Probe types
kprobe: yes tracepoint: yes
perf_event: yes fentry: yes
kprobe_multi: yes uprobe_multi: yes
kprobe_session: yes iter: yes
Example output:
Attached 2 probes
22:42:28 uid = 1000 pid = 1843 ppid = 692 cmd_with_args = /usr/lib/systemd/systemd-executor --deserialize --log-level auto pg8� �q`]U
22:42:28 uid = 1000 pid = 1843 ppid = 692 cmd = 9
22:42:28 uid = 1000 pid = 1843 ppid = 692 cmd_with_args = /usr/bin/konsole
22:42:28 uid = 1000 pid = 1843 ppid = 692 cmd = konsole
22:42:28 uid = 1000 pid = 1852 ppid = 797 cmd_with_args = /usr/bin/rm /home/username/.config/session/konsole_10145dbd1dd000176514014800000007970007_1765140148_399358
22:42:28 uid = 1000 pid = 1852 ppid = 797 cmd = rm
22:42:28 uid = 1000 pid = 1854 ppid = 1853 cmd_with_args = /usr/lib/utempter/utempter add
22:42:28 uid = 1000 pid = 1854 ppid = 1853 cmd = utempter
22:42:28 uid = 1000 pid = 1853 ppid = 1843 cmd_with_args = /usr/bin/bash �����
22:42:28 uid = 1000 pid = 1853 ppid = 1843 cmd = bash
@jordalgo could this be related to the recent char[] -> string conversion in #4871?
@viktormalik Don't believe so. The user reported this for 0.24.1.
This has been fixed in 5e8702aa28bb04ef4aaf25f955b048ecd8075085. We've backported it to release/0.24.x (ff000c23291d1487bebe05b59a40c36c97bd1688) but never released a patch release containing this. IIRC,@jordalgo wanted to craft the 0.24.2 release, are we waiting for anything else here?
@viktormalik Let me do another check and then I'll work on the 0.24.2 release this week.