diff --git a/userspace/libsinsp/parsers.cpp b/userspace/libsinsp/parsers.cpp index 78e09e3f87..d6eacc3f8e 100644 --- a/userspace/libsinsp/parsers.cpp +++ b/userspace/libsinsp/parsers.cpp @@ -2678,6 +2678,14 @@ void sinsp_parser::parse_open_openat_creat_exit(sinsp_evt *evt) ino = evt->get_param(6)->as(); } } + else if(etype == PPME_SYSCALL_OPENAT2_X && evt->get_num_params() > 6) + { + dev = evt->get_param(6)->as(); + if (evt->get_num_params() > 7) + { + ino = evt->get_param(7)->as(); + } + } // // Compare with enter event parameters @@ -2706,16 +2714,19 @@ void sinsp_parser::parse_open_openat_creat_exit(sinsp_evt *evt) } else if (etype == PPME_SYSCALL_OPEN_BY_HANDLE_AT_X) { - /* - * Flags - */ flags = evt->get_param(2)->as(); - /* - * Path - */ name = evt->get_param(3)->as(); + if(etype == PPME_SYSCALL_OPEN_BY_HANDLE_AT_X && evt->get_num_params() > 4) + { + dev = evt->get_param(4)->as(); + if (evt->get_num_params() > 5) + { + ino = evt->get_param(5)->as(); + } + } + // since open_by_handle_at returns an absolute path we will always start at / sdir = ""; }