Mattia Meleleo

Hi @ti-mo , I forgot about this issue (and haven't had much time to investigate anyway). I'll try to investigate it soon

I've retested on a debian 9 VM and it works: ``` bpf prog SEC("uprobe/traceme") int uprobe_traceme(struct pt_regs *ctx) { bpf_printk("OK"); return 0; } ``` ``` tracer ... ex, err :=...

I've renamed the issue so it's less scary :). As written on slack, I've tested this manually with two different 4.9 kernels and the uprobe fires, so it's most likely...

> Do you have a link to the corresponding upstream patch set? https://patchwork.kernel.org/project/netdevbpf/list/?series=623878&state=* I think there are also some bugfixes which are not part of that set > Should we...

> @mmat11 @ti-mo is there easy way to use the multi kprobe detection check from user code? I could expose `HaveKprobeMultiLink` in the features package

> As discussed offline, leaving this review to highlight the main points I'd liked to see differently while hacking on this code. Mostly cleaned up the middle part of kprobeMulti...

> It drops retprobe calls, without being able to work around the limitation? Asked another way, what does it mean that maxactive is 0 in the pmu case? I believe...

hi @claudiamarcubina I opened https://github.com/inspektor-gadget/inspektor-gadget/pull/2798 but I am not sure I covered both initial and new containers; can you have a look when you have time and perhaps start a...

I guess these can be removed then https://github.com/elastic/beats/blob/main/auditbeat/Jenkinsfile.yml#L33-L50

> In particular, I don't think increasing the TCP buffer sizes to 2KB each is something we want to do - that adds about 3.5 kb per trace in the...