Incoherencies between trace file and live output when execve is filtered out

[gianlucaborello]

If the execve/clone for a process is filtered out, and the instrumented process is started when sysdig is already running, then the output on screen will not be coherent with the content of the dump file.

1. Despite the filter, output on screen is shown correctly:

$ sudo sysdig proc.name=ls and evt.type=openat
2612 20:44:02.098120967 3 ls (58315) > openat dirfd=-100(ENETDOWN) name=. flags=1089 mode=0
2613 20:44:02.098123141 3 ls (58315) < openat fd=3(<f>/home/gianluca)
...
$

2. Same as 1), but the trace is now saved

$ sudo sysdig -w dump.scap proc.name=ls and evt.type=openat
$

3. A user would expect the same output as 1), but instead a bunch of NA are shown

$ sysdig -r dump.scap
1 20:44:22.779774434 1 <NA> (58318) > openat dirfd=-100(ENETDOWN) name=. flags=1089 mode=0
2 20:44:22.779776464 1 <NA> (58318) < openat fd=3(<f>)
$

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.