How to use output options in a correct manner?

[sbmthakur]

I am passing the option detect-syscall in the following way.

docker run   --name tracee --rm -it   \
     --pid=host --cgroupns=host --privileged   \
     -v /etc/os-release:/etc/os-release-host:ro -v /tmp/tracee:/tmp/tracee \
     -e LIBBPFGO_OSRELEASE_FILE=/etc/os-release-host \
     -e TRACEE_EBPF_ONLY=1  \
      aquasec/tracee:latest --trace container=xxxxx --output table --output detect-syscall`

It results in the following error:

2022/05/12 20:32:16 unrecognized output format: detect-syscall. Valid format values: 'table', 'table-verbose', 'json', 'gob' or 'gotemplate='. Use '--output help' for more info.

What's the correct way to pass those options?

[rafaeldtinoco]

Hello @sbmthakur, can you try something like:

-o format:json -o option:parse-arguments -o option:detect-syscall -trace comm=bash -trace follow

And you can change "json" to other output format types. In here I'm filtering all "bash processes" and "all its childs". Hope it helps, let me know if you have any other questions, might help others as well.

Thanks