Djalal Harouni

Hi @Jianlin-lv no worries, thank you very much for your contributions ;-) ! BTW if ci test fail on 4.9 kernel for bpf complexity, you can surround your bpf changes...

Hi @Jianlin-lv as pointed out by Kornilios those tests will help you to isolate tests and better debug. Also I remember when I took a look quickly it hints toward...

> hi guys, sorry for interrupt , I didn't have any progress from my side, because vm testing env setup failed on my VM. Could you help to take a...

@jrfastab the namespace I added is "observability", doing "tracing" is an alternative, strictly speaking they are flexible. But I prefer to have it "observability.tracing" for things bpf, kprobes, etc instead...

> Thanks that's a good addition! I just have some remarks on the Go code that could be simplified I think to be easier to read. > > I'm not...

> overall I agree tag fields are useful way for user to get a field they can use for DB or whatever event monitoring system for filtering, categorizing, etc. But,...

> Thanks that's a good addition! I just have some remarks on the Go code that could be simplified I think to be easier to read. > > I'm not...

> @tixxdz I'm all for groupings by tags and a default set of tags for different groups of observability and enforcement. I still don't follow why that needs to be...

> Back to the issue, auid should be supposed to my login/real user Id. Somehow it's always 4294967295. uid is my current user Id, as I switched to root, this...

> Hey @tixxdz, thanks for sharing! > > Quick question, does the `auid` ever work for you? Was it able to correctly show the real login users in some cases?...