How to get the complete behavior of the program, including the behavior of the child process
Author: cc-sirCreated Mar 29, 2021Updated Dec 12, 2023
Labelspinnedfeature-request
I need to track all the system calls of the process, but I can't get the behavior of the child process, the command I usually use is "sudo sysdig proaname=sir or proc.name=sir or proc.apid=5478"; However, I cannot get the behavior of the cloned child process:
....
43298 17:34:02.341990766 0 sir (5481) < getppid
43299 17:34:02.341990908 0 sir (5481) > clock_gettime
43300 17:34:02.341992129 0 sir (5481) < clock_gettime
43301 17:34:02.341993573 0 sir (5481) > prctl
43302 17:34:02.341994491 0 sir (5481) < prctl
43303 17:34:02.341994693 0 sir (5481) > write fd=1(<p>) size=15
43304 17:34:02.341996217 0 sir (5481) < write res=15 data=listening tun0.
43305 17:34:02.341996500 0 sir (5481) > write fd=1(<p>) size=1
43306 17:34:02.341996921 0 sir (5481) < write res=1 data=.
43307 17:34:02.341997228 0 sir (5481) > clone
43308 17:34:02.342019416 0 sir (5481) < clone res=5482(57335egcrrhiwci) exe=1e7nuh8nwl7ndapv args=ir. tid=5481(sir) pid=5481(sir) ptid=5478(python) cwd= fdlimit=1024 pgft_maj=0 pgft_min=120 vm_size=1148 vm_rss=4 vm_swap=0 comm=57335egcrrhiwci cgroups=cpuset=/.cpu=/.cpuacct=/.io=/.memory=/user.slice/user-1000.slice/[email protected]... flags=25165824(CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID) uid=1000 gid=1000 vtid=5481(sir) vpid=5481(sir)
43309 17:34:02.342034191 0 sir (5481) > exit_group
43310 17:34:02.342050709 0 sir (5481) > procexit status=0
What should I do or what command should I use, thanks!
Source: draios/sysdig