log the UID of exec events

gustavo-iniguez-goya · gustavo-iniguez-goya · commit aeb2018d27fc · 2025-04-24T23:55:42.000+02:00
diff --git a/daemon/procmon/ebpf/events.go b/daemon/procmon/ebpf/events.go
@@ -238,7 +238,7 @@ func processExecEvent(event *execEvent) {
 	if proc == nil {
 		return
 	}
-	log.Debug("[eBPF exec event] type: %d, ppid: %d, pid: %d, %s -> %s", event.Type, event.PPID, event.PID, proc.Path, proc.Args)
+	log.Debug("[eBPF exec event] type: %d, ppid: %d, pid: %d, uid: %d, %s -> %s", event.Type, event.PPID, event.PID, event.UID, proc.Path, proc.Args)
 	itemParent, pfound := procmon.EventsCache.IsInStoreByPID(proc.PPID)
 	if pfound {
 		proc.Parent = &itemParent.Proc
@@ -258,7 +258,7 @@ func processExecEvent(event *execEvent) {
 	}
 
 	// from now on use cached Process
-	log.Debug("[eBPF event inCache] -> %d, %s", event.PID, item.Proc.Path)
+	log.Debug("[eBPF event inCache] pid: %d, uid: %d, %s", event.PID, event.UID, item.Proc.Path)
 }
 
 // event2process creates a new Process from execEvent

Original file line number	Diff line number	Diff line change
`@@ -238,7 +238,7 @@ func processExecEvent(event *execEvent) {`
`238`	`238`	`if proc == nil {`
`239`	`239`	`return`
`240`	`240`	`}`
`241`		`- log.Debug("[eBPF exec event] type: %d, ppid: %d, pid: %d, %s -> %s", event.Type, event.PPID, event.PID, proc.Path, proc.Args)`
	`241`	`+ log.Debug("[eBPF exec event] type: %d, ppid: %d, pid: %d, uid: %d, %s -> %s", event.Type, event.PPID, event.PID, event.UID, proc.Path, proc.Args)`
`242`	`242`	`itemParent, pfound := procmon.EventsCache.IsInStoreByPID(proc.PPID)`
`243`	`243`	`if pfound {`
`244`	`244`	`proc.Parent = &itemParent.Proc`
`@@ -258,7 +258,7 @@ func processExecEvent(event *execEvent) {`
`258`	`258`	`}`
`259`	`259`
`260`	`260`	`// from now on use cached Process`
`261`		`- log.Debug("[eBPF event inCache] -> %d, %s", event.PID, item.Proc.Path)`
	`261`	`+ log.Debug("[eBPF event inCache] pid: %d, uid: %d, %s", event.PID, event.UID, item.Proc.Path)`
`262`	`262`	`}`
`263`	`263`
`264`	`264`	`// event2process creates a new Process from execEvent`