draios/sysdig — pull request #260 by danielwippermann (2014-10-07 19:09:02+00:00)
Title: Add `symlink(at)?` syscalls. Add `evt.abspath` filter field.

This commit adds support for the following syscalls:

- symlink
- symlinkat

In addition to those syscalls a new set of filter fields was added:

- evt.abspath
- evt.abspath.src
- evt.abspath.dst

Those field are only used for the syscalls `renameat`and `symlinkat`
but might be later used for other `...at` syscalls as well (e.g.
`openat`, `linkat` and `unlinkat`). The purpose of the filter fields
is to aggregate the values of corresponding `dirfd` and `name`
parameters to form an absolute path.

Example:

# sysdig "evt.type = symlinkat" -p "*%evt.dir %evt.type %evt.args %evt.abspath"
> symlinkat
< symlinkat res=0 target=../../test linkdirfd=3(/home/vagrant/dir1/dir2) linkpath=test /home/vagrant/dir1/dir2/test

((This covers bullets 1 and 2 discussed in https://github.com/draios/sysdig/pull/259 , bullet 3 is coming in a future PR))