Tools: add the PPID/PCOMM fields in mountsnoop
authorWen Yang <wenyang@linux.alibaba.com>
Wed, 21 Apr 2021 08:21:56 +0000 (16:21 +0800)
committeryonghong-song <ys114321@gmail.com>
Sat, 24 Jul 2021 17:17:10 +0000 (10:17 -0700)
commit246450117d4f58f5f5fec7bb9b7ba2632141a63f
tree10e181f8d25b5121c9794d78f63d6cd9fc60359e
parentd8176d2df9951975a1fd47bbf021daf3f435c70c
Tools: add the PPID/PCOMM fields in mountsnoop

It is found that in the production environment, the system() function
or shell command is often used to start the mount process temporarily,
so the PPID/PCOMM field needs to be added to find the corresponding program.

Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
tools/mountsnoop.py
tools/mountsnoop_example.txt