Sample Header Ad - 728x90

How to get argv[0] in bpftrace?

2 votes
1 answer
566 views
I have this rather simple script:
#!/usr/bin/bpftrace
tracepoint:syscalls:sys_enter_exec*
{
    @start[pid] = nsecs;
    printf("START;%-6d;", pid);
	join(args->argv);
}
tracepoint:syscalls:sys_enter_exit*
{
    $from = @start[pid];
    $until = nsecs;
	printf("STOP;%-5d;%-16d\n", pid, $until-$from);
}
I'd much rather have it print args->argv instead of printing the often multi-line join(args->argv). Problem is that printf("START;%-6d;%s", pid, args->argv); doesn't work:
/tmp/foo.bt:5:5-48: ERROR: printf: %s specifier expects a value of type string (integer supplied)
    printf("START;%-6d;%s", pid, args->argv);
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
pretty sure args->argv is a string array, so this kind of surprises me. How do I solve this?
Asked by Marcus Müller (47107 rep)
Sep 19, 2023, 09:49 AM
Last activity: Dec 14, 2023, 09:13 AM