sysflow
sysflow copied to clipboard
Script name appears in Exe args
Indicate project libsysflow
Describe the bug When executing a script, the script name appears in the Exe args field
To reproduce Steps to reproduce the behavior:
- Build and run sf-collector example
- Create and run a bash script from terminal
Expected behavior The script name should appear only in the Exe field (as done with binaries)
Environment (please complete the following information):
- OS: Ubuntu 20.04.4 LTS
- kernel: 5.4.0-128-generic
- SysFlow version: v0.5.1 (from master branch)
- Configurations (if applicable): eBPF driver
sf-collector example log
****************************************************************
Header: Exporter , IP , File name
Process: PID 13246 Creation Time, 1688462767702306855, Exe /usr/bin/bash, Exe Args , User Name vagrant, Group Name vagrant, TTY 1
Proc Evt: TID 13246, OpFlags 1, Ret 14128
****************************************************************
****************************************************************
Header: Exporter , IP , File name
Process: PID 14128 Creation Time, 1688462920057048358, Exe /usr/bin/bash, Exe Args , User Name vagrant, Group Name vagrant, TTY 1
Proc Evt: TID 14128, OpFlags 1, Ret 0
****************************************************************
****************************************************************
Header: Exporter , IP , File name
Process: PID 14128 Creation Time, 1688462920057048358, Exe /home/vagrant/script.sh, Exe Args ./script.sh, User Name vagrant, Group Name vagrant, TTY 1
Proc Evt: TID 14128, OpFlags 2, Ret 0
****************************************************************
****************************************************************
Header: Exporter , IP , File name
Process: PID 14128 Creation Time, 1688462920057048358, Exe /home/vagrant/script.sh, Exe Args ./script.sh, User Name vagrant, Group Name vagrant, TTY 1
File: Type 102, Path /etc/ld.so.cache
File Flow: TID 14128, OpFlags: 9344, OpenFlags 4097, FD 3
****************************************************************