diff --git a/pkg/ebpf/c/tracee.bpf.c b/pkg/ebpf/c/tracee.bpf.c index 6cc7c5d81a6f..d364de379872 100644 --- a/pkg/ebpf/c/tracee.bpf.c +++ b/pkg/ebpf/c/tracee.bpf.c @@ -1405,6 +1405,7 @@ int sched_process_exec_event_submit_tail(struct bpf_raw_tracepoint_args *ctx) save_to_submit_buf(&p.event->args_buf, &stdin_type, sizeof(unsigned short), 12); save_str_to_buf(&p.event->args_buf, stdin_path, 13); save_to_submit_buf(&p.event->args_buf, &invoked_from_kernel, sizeof(int), 14); + save_str_to_buf(&p.event->args_buf, (void *) p.task_info->context.comm, 15); if (p.config->options & OPT_EXEC_ENV) { unsigned long env_start, env_end; env_start = get_env_start_from_mm(mm); @@ -1412,7 +1413,7 @@ int sched_process_exec_event_submit_tail(struct bpf_raw_tracepoint_args *ctx) int envc = get_envc_from_bprm(bprm); save_args_str_arr_to_buf( - &p.event->args_buf, (void *) env_start, (void *) env_end, envc, 15); + &p.event->args_buf, (void *) env_start, (void *) env_end, envc, 16); } events_perf_submit(&p, 0); diff --git a/pkg/events/core.go b/pkg/events/core.go index 683933e6555c..5f1544137f49 100644 --- a/pkg/events/core.go +++ b/pkg/events/core.go @@ -11229,6 +11229,7 @@ var CoreEvents = map[ID]Definition{ {Type: "umode_t", Name: "stdin_type"}, {Type: "char*", Name: "stdin_path"}, {Type: "int", Name: "invoked_from_kernel"}, + {Type: "const char*", Name: "prev_comm"}, {Type: "const char**", Name: "env"}, }, },