Skip to content

sysdig.set_filter breaks other chisels when using evt.dir=< #2152

@gitamarme

Description

@gitamarme

From version 0.39 and forward

setting sysdig filter with evt.dir=< (specifically , evt.dir=> still works)

the filter drops events and does not forward them to chisel filters.

can be reproduces with the following:


args = {
    {
        name = "test",
        description = "sysdig bug",
        argtype = "number",
        optional = true
    }
}


function on_init()
    f_proc_pid = chisel.request_field("proc.pid")
    f_proc_duration = chisel.request_field("proc.duration")
    f_evt_rawtime = chisel.request_field("evt.rawtime")
    
    -- when this is included in sysdig filter no event would be triggered comment it to see the bug
    sysdig.set_filter("evt.dir=<")
    -- write anything to any file for example
    chisel.set_filter("evt.dir=< and evt.type=write and fd.typechar=f")
    
    return true
end



function on_event() 
    --wont be triggered when sysdig filter is on
    print("event triggered")

    return true
end

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions