proc.parentpid->proc.ppid and proc.parentname->proc.pname

Author: ldegio

userspace/libsinsp/filterchecks.cpp

@@ -656,8 +656,8 @@ const filtercheck_field_info sinsp_filter_check_thread_fields[] =
 	{PT_CHARBUF, EPF_NONE, PF_NA, "proc.args", "the arguments passed on the command line when starting the process generating the event."},
 	{PT_CHARBUF, EPF_NONE, PF_NA, "proc.cwd", "the current working directory of the event."},
 	{PT_UINT32, EPF_NONE, PF_DEC, "proc.nchilds", "the number of child threads of that the process generating the event currently has."},
-	{PT_INT64, EPF_NONE, PF_DEC, "proc.parentpid", "the pid of the parent of the process generating the event."},
-	{PT_CHARBUF, EPF_NONE, PF_NA, "proc.parentname", "the name (excluding the path) of the parent of the process generating the event."},
+	{PT_INT64, EPF_NONE, PF_DEC, "proc.ppid", "the pid of the parent of the process generating the event."},
+	{PT_CHARBUF, EPF_NONE, PF_NA, "proc.pname", "the name (excluding the path) of the parent of the process generating the event."},
 	{PT_INT64, EPF_NONE, PF_DEC, "thread.tid", "the id of the thread generating the event."},
 	{PT_BOOL, EPF_NONE, PF_NA, "thread.ismain", "'true' if the thread generating the event is the main one in the process."},
 	{PT_RELTIME, EPF_NONE, PF_DEC, "thread.exectime", "Thread execution time. Exported only by switch events."},

userspace/sysdig/chisels/spy_users.lua

@@ -33,7 +33,7 @@ function on_init()
 	fuser = chisel.request_field("user.name")
 
 	-- set the filter
-	chisel.set_filter("(evt.type=execve and not proc.name contains sh and proc.parentname contains sh) or (evt.type=chdir and evt.dir=< and proc.name contains sh)")
+	chisel.set_filter("(evt.type=execve and not proc.name contains sh and proc.pname contains sh) or (evt.type=chdir and evt.dir=< and proc.name contains sh)")
 
 	return true
 end