On Fri, Mar 20, 2026 at 02:48:34PM -0400, Steven Rostedt wrote: > On Fri, 20 Mar 2026 14:21:23 +0100 > Christian Brauner <[email protected]> wrote: > > > > +TRACE_EVENT(coredump, > > > + > > > + TP_PROTO(int sig), > > > + > > > + TP_ARGS(sig), > > > + > > > + TP_STRUCT__entry( > > > + __field(int, sig) > > > + __array(char, comm, TASK_COMM_LEN) > > > + __field(pid_t, pid) > > > + ), > > > + > > > + TP_fast_assign( > > > + __entry->sig = sig; > > > + memcpy(__entry->comm, current->comm, TASK_COMM_LEN); > > > + __entry->pid = current->pid; > > > > That's the TID as seen in the global pid namespace. > > I assume this is what you want but worth noting. > > Not to mention the pid is saved in all trace events and is available for > perf and bpf too. Even the change log showed it: > > sleep-634 [036] ..... 145.222206: coredump: sig=11 > comm=sleep pid=634 > > ^^^ > ^^^ > > So it should not be included. It's duplicate and only wastes space. Now if > you wanted to save the name space pid, that may be useful.
In my use case, I don't need the namespace pid since I'm primarily focused on system-wide monitoring, and the global pid is sufficient for my purposes. Thanks for the heads-up. I'll update the patch to remove the pid field. Thanks, --breno
