From ee341a6b690116006bd016a13785734feb0420f8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Geyslan=20Greg=C3=B3rio?= Date: Thu, 16 Feb 2023 14:53:21 -0300 Subject: [PATCH] log when not a container cgroup instead of err --- pkg/ebpf/events_processor.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkg/ebpf/events_processor.go b/pkg/ebpf/events_processor.go index 44976617a7b1..9e3414a21687 100644 --- a/pkg/ebpf/events_processor.go +++ b/pkg/ebpf/events_processor.go @@ -270,7 +270,13 @@ func (t *Tracee) processCgroupMkdir(event *trace.Event) error { // If cgroupId is from a regular cgroup directory, and not the // container base directory (from known runtimes), it should be // removed from the containers bpf map. - err = t.containers.RemoveFromBpfMap(t.bpfModule, cgroupId, hId) + if err := t.containers.RemoveFromBpfMap(t.bpfModule, cgroupId, hId); err != nil { + // If the cgroupId was not found in bpf map, this could mean that + // it is not a container cgroup and, as a systemd cgroup, could have been + // created and removed very quickly. + // In this case, we don't want to return an error. + logger.Debug("failed to remove entry from containers bpf map", "error", err) + } } return err }