draios/sysdig — pull request #246 by dhbaird (2014-09-17 03:03:09+00:00)
Title: Hook the rename() and renameat() syscalls.

Hello, I've hooked the `rename()` and `renameat()` syscalls. Here is an example chisel:

```lua
f_evt_arg_oldpath = chisel.request_field("evt.arg.oldpath");
f_evt_arg_newpath = chisel.request_field("evt.arg.newpath");
if "rename" == evt.field(f_evt_type) and "<" == evt.field(f_evt_dir) then
print(json.encode({type="" == evt.field(f_evt_dir) then
print(json.encode({type=">rename", oldpath=evt.field(f_evt_arg_oldpath),
newpath=evt.field(f_evt_arg_newpath), cwd=evt.field(f_proc_cwd)}));
end
```

In `parse_rename_renameat_exit()`, I attempted to compute `fulloldpath` and `fullnewpath` but then I didn't know where to put the computed result (so it goes nowhere!).

Willing to do extra work if needed to clean up patch. Thanks for your time reviewing it.