@@ -254,9 +254,8 @@ func (e *JsonEnricher) Run(ctx context.Context, runErr chan<- error) {
254
254
255
255
bpfProcCache := bpfrecorder .NewBpfProcessCache (e .logger )
256
256
257
- errBpf := bpfProcCache .Load ()
258
- if errBpf != nil {
259
- e .logger .Info ("Unable to load BPF module. Using auditd" , "err" , errBpf .Error ())
257
+ if err := bpfProcCache .Load (); err != nil {
258
+ e .logger .Info ("Unable to load BPF module. Using auditd" , "err" , err .Error ())
260
259
} else {
261
260
e .bpfProcessCache = bpfProcCache
262
261
}
@@ -346,23 +345,30 @@ func (e *JsonEnricher) processEbpf(logBucket *types.LogBucket, auditLine *types.
346
345
if errCmdLine == nil {
347
346
logBucket .ProcessInfo .CmdLine = cmdLine
348
347
349
- e .logger .V (1 ).Info ("cmd line found in eBPF" )
348
+ e .logger .V (1 ).Info ("cmdline found in eBPF" ,
349
+ "processId" , auditLine .ProcessID , "cmdLine" , cmdLine )
350
350
} else {
351
- e .logger .V (1 ).Info ("cmd line not found in eBPF also" )
351
+ e .logger .V (1 ).Info ("cmdline not found in eBPF also" ,
352
+ "processId" , auditLine .ProcessID )
352
353
}
353
354
}
354
355
355
356
if e .bpfProcessCache != nil && logBucket .ProcessInfo != nil && logBucket .ProcessInfo .ExecRequestId == nil {
356
- procEnv , errCmdLine := e .bpfProcessCache .GetEnv (auditLine .ProcessID )
357
- if errCmdLine == nil {
357
+ procEnv , errEnv := e .bpfProcessCache .GetEnv (auditLine .ProcessID )
358
+ if errEnv == nil {
358
359
reqId , ok := procEnv [requestIdEnv ]
359
- if ok {
360
+ if ! ok {
361
+ e .logger .V (1 ).Info ("exec request id info not found in eBPF also" ,
362
+ "processId" , auditLine .ProcessID )
363
+ } else {
360
364
logBucket .ProcessInfo .ExecRequestId = & reqId
361
365
362
- e .logger .V (1 ).Info ("Exec request id info found in eBPF" )
363
- } else {
364
- e .logger .V (1 ).Info ("Exec request id info not found in eBPF also" )
366
+ e .logger .V (1 ).Info ("exec request id info found in eBPF" , "reqId" , reqId ,
367
+ "processId" , auditLine .ProcessID )
365
368
}
369
+ } else {
370
+ e .logger .V (1 ).Error (errEnv , "fetching exec request id" ,
371
+ "processId" , auditLine .ProcessID )
366
372
}
367
373
}
368
374
}
0 commit comments