Omit SIGKILL event in centos7 with kernel 3.10.0

Open

#2,000 opened on Jun 20, 2023 5 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 35/100

Issue type: Bug
Clarity: Needs clarification
Activity status: Stale
Tech stack: centos, docker, kubernetes, linux
Domain: observability-sre, operating-systems

Research direction

Reproduce the reported command, sysdig evt.type=kill and evt.arg.sig=SIGKILL, on CentOS 7 with kernel 3.10.0, both on the host and inside a Docker container. Compare the observed events with the supplied screenshots and runtime versions to determine whether SIGKILL events are omitted and document how the behavior should work.

Written by the indexing model from the issue text.

Description

feature-request pinned

I think sysdig may omit some event in centos7 with kernel 3.10.0

Runtime Information

System:
CentOS Linux release 7.9.2009 (Core)

Kernel:
3.10.0-1160.el7.x86_64

Sysdig:
0.35.1

Docker:

Client: Docker Engine - Community
 Version:           20.10.23
 API version:       1.40
 Go version:        go1.18.10
 Git commit:        7155243
 Built:             Thu Jan 19 17:36:21 2023
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          19.03.15
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.13.15
  Git commit:       99e3ed8919
  Built:            Sat Jan 30 03:16:33 2021
  OS/Arch:          linux/amd64
  Experimental:     true
 containerd:
  Version:          1.6.15
  GitCommit:        5b842e528e99d4d4c1686467debf2bd4b88ecd86
 runc:
  Version:          1.0.3
  GitCommit:        v1.0.3-0-gf46b6ba
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683

Problem

I want to detect SIGKILL signal event inside container.
So I run the below command on the host machine.

sysdig evt.type=kill and evt.arg.sig=SIGKILL

Below is the output.

kill inside container

Then I execute a kill command inside a k8s docker container located at this host machine.

I cannot see the kill command's system call event in the first picture.

kill inside host machine

Obviously, I still cannot see the kill command's event.

Conclusion

I think sysdig cannot work well in the centos7 with kernel 3.10.0. Or how can I make it work well?

Dominant language: C++
Stars: 8.3k
Forks: 753
PR merge metrics: No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

[Bug] NULL pointer dereference in llm_running_callback (NGZA-AX-LLM #3) Open

Difficulty 1/5 Under an hour Newbie friendliness 90/100

AXERA-TECH/ax-llm#77 · Opened Sep 22, 2026
resume() sends a second HTTP response (400) after a successful resume Open

Difficulty 1/5 Under an hour Newbie friendliness 90/100

games-on-whales/wolf#509 · Opened Sep 21, 2026
pn7160: reader goes permanently deaf — post-read IRQ-low check fails reads that succeeded Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

esphome/esphome#19452 · Opened Sep 21, 2026
Eval bug: Ministral-3 tool-calls during reasoning are not processed Open

bug-unconfirmed

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

ggml-org/llama.cpp#29248 · Opened Sep 21, 2026
run_tests.py fails on windows, but running tests individually works Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

NVIDIA/cuda-samples#453 · Opened Sep 21, 2026

More C++ issues