Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Test_TraceeCapture/capture_packet_context pcaps error #4192

Open
geyslan opened this issue Jul 16, 2024 · 1 comment
Open

Test_TraceeCapture/capture_packet_context pcaps error #4192

geyslan opened this issue Jul 16, 2024 · 1 comment
Labels

Comments

@geyslan
Copy link
Member

geyslan commented Jul 16, 2024

Description

#4072 introduced pcaps capture_packet_context test which is emitting pcaps errors:

{"level":"error","ts":1720688021.7947063,"msg":"Could not write pcap data","err":"pcaps.(*Pcaps).Write: pcaps.(*PcapCache).get: pcaps.NewPcap: pcaps.getPcapFileAndWriter: utils.OpenAt: no such file or directory"}

https://github.com/aquasecurity/tracee/actions/runs/9888233128/job/27311895433?pr=4072#step:4:631

Output of tracee version:

main
@oshaked1
Copy link
Contributor

oshaked1 commented Jul 16, 2024

I noticed this a short while ago and opened an issue about it (#4068). This is caused by incorrect context being generated for packets, which causes packets to arrive from kernel threads which have a "/" in their name thus causing path errors. This incorrect context can be seen when using --events network_events.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants