diff --git a/bpf/process/bpf_execve_event.c b/bpf/process/bpf_execve_event.c index 109701dcca..3d279264ab 100644 --- a/bpf/process/bpf_execve_event.c +++ b/bpf/process/bpf_execve_event.c @@ -130,6 +130,10 @@ event_filename_builder(void *ctx, struct msg_process *curr, __u32 curr_pid, __u3 curr->ktime = ktime_get_ns(); curr->size = size + offsetof(struct msg_process, args); + // skip binaries check for long (> 255) filenames for now + if (flags & EVENT_DATA_FILENAME) + return 0; + heap = map_lookup_elem(&execve_heap, &zero); if (!heap) return 0;