Comments (1)
The command echo is a shell builtin. With changes related to console, ref issue #32, we no longer see the duplicates.
When the built in echo is used we emit one event for the console only:
{"type":"evt","body":{"sourcetype":"console","id":"ubuntu-sh-/home/donn/scope/utils/dupcon.sh","_time":1611784048.773,"source":"stdout","host":"ubuntu","proc":"sh","cmd":"/bin/sh /home/donn/scope/utils/dupcon.sh","pid":235998,"_channel":"251529653813764","data":"foo 1\n"}}
We see a new process, sh, started for each echo command in the event stream. One and only one console event.
When /usr/bin/echo is used in place of the built in echo we see 1 event for each echo'd line; "foo 1", "foo 2", et. al.
We also see a console event for the new line; "\n" for every /usr/bin/echo. This is due to how glibc handles the new line.
There is a separate issue defined for combining console data such that we don't get the separate event for new line. Soon.
{"type":"evt","body":{"sourcetype":"console","id":"ubuntu-echo-/usr/bin/echo foo 1","_time":1611783662.906,"source":"stdout","host":"ubuntu","proc":"echo","cmd":"/usr/bin/echo foo 1","pid":235324,"_channel":"250529492523466","data":"foo 1"}}
{"type":"evt","body":{"sourcetype":"console","id":"ubuntu-echo-/usr/bin/echo foo 1","_time":1611783662.907,"source":"stdout","host":"ubuntu","proc":"echo","cmd":"/usr/bin/echo foo 1","pid":235324,"_channel":"250529492523466","data":"\n"}}
from appscope.
Related Issues (20)
- Mount the socket dir not the socket file
- ld.so.preload and scope in the PATH HOT 1
- Go build error with ld.so.preload enabled HOT 2
- top on Fedora error HOT 1
- Config is not getting set correctly in rules file or in attach when using filter --add HOT 6
- scope attach --inspect <pid> from container to host can return error when successful HOT 1
- Warning when scoping an an application that has the s bit set
- Use symbolic link to avoid two appscope libraries in one process
- [Bug]: Missing payload (request) using `host` app HOT 1
- Timeouts seen with appscope/edge integration HOT 2
- DNS tunelling/exfiltration POC HOT 3
- File system obfuscation
- Add support for sending the payloads using event channel HOT 3
- LD_PRELOAD is not set in some cases when exec'ing into a container that was started after a scope rule was added
- Unable to exec into container after re-adding a scope rule HOT 4
- Connection Graph HOT 1
- [Bug]: Sending payloads with cribl/event transport type - inconsistency with channel type
- Memory Snapshot on Command HOT 1
- Attempt to mount non-existent directory from host into container HOT 2
- Updates needed to CI
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from appscope.