criblio
Scoped `dockerd` does not produce events, it only produces metrics.
Steps To Reproduce
root@precision:/home/sean/sandbox# scope attach dockerd
WARNING: Session history will be stored in /root/.scope/history and owned by root
Attaching to process 3029
root@precision:/home/sean/sandbox# scope metrics
NAME VALUE TYPE UNIT PID TAGS
proc.start 1 Count process 3029 args: /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.s…
proc.cpu 3.990642489e+09 Count microsecond 3029 host: precision,proc: dockerd
proc.cpu_perc 39906.42489 Gauge percent 3029 host: precision,proc: dockerd
proc.mem 3.905616e+06 Gauge kibibyte 3029 host: precision,proc: dockerd
proc.thread 42 Gauge thread 3029 host: precision,proc: dockerd
proc.fd 25 Gauge file 3029 host: precision,proc: dockerd
proc.child 41 Gauge process 3029 host: precision,proc: dockerd
root@precision:/home/sean/sandbox# scope events
Empty event file.
Environment
- AppScope: 1.3.1
- OS: ubuntu 22.04
- Architecture: x86
- Kernel: 5.19.0-38-generic
Requested priority
None
Relevant log output
No response
Refer to #1416. This is resolved there.
Note that interposition fails when attaching to dockerd because runtime/internal/syscall.Syscall6 cannot be resolved. It does locate runtime/internal/syscall.Syscall6.abi0. Will need to determine why and if the abi0 version can be used in all cases.
I think the syscall.Syscall6 describes why we aren't seeing any events, and why we can see metrics. (metrics don't depend on the syscall.Syscall6 instrumentation)
On my system (an aarch64 ubuntu 20.04) I also saw this log message from the time of attach:
Scope: dockerd(pid:776): [2023-04-18T20:41:21.609+0000] /usr/bin/dockerd was compiled with go version `go1.16.12`. AppScope can only instrument go1.19 or newer on ARM64. Continuing without AppScope.
We are continuing to get metrics, so I'm not exactly sure what to make of the log message.
Documented as a Known Issue in AppScope 1.3.2: https://appscope.dev/docs/known-issues
