-
Notifications
You must be signed in to change notification settings - Fork 727
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
The situation where syscall events are lost when tracing programs with frequent system calls. #2049
Comments
Hey @ChrisLiCheng! At the moment this feature is not supported but it could be great to have it! I don't think it's particularly difficult to implement but I don't know if we can make it for the |
Hey @therealbobo! Thank you for your offer and willingness to provide guidance. I am happy to help and contribute to this project. Please let me know what needs to be done and how I should get started. Looking forward to your further instructions. |
Hey @ChrisLiCheng! Sorry for the delay! You could start taking a look at how it's done in falco userspace/falco/app/actions/helpers_inspector.cpp. At the end is just matter of changing the buffer size on the open of the engine (
|
I captured system call events of a container using sysdig and saved the events to a file. In my subsequent analysis, I noticed that some events were missing. I'm wondering if this might be due to sysdig not being configured with an appropriate ring buffer size when it was started, resulting in event loss. Can sysdig be configured to modify the ring buffer size?
The text was updated successfully, but these errors were encountered: