Re: [PATCH] coredump: add tracepoint for coredump events

[Breno Leitao <leitao@debian.org>]

On Fri, Mar 20, 2026 at 02:48:34PM -0400, Steven Rostedt wrote:
> On Fri, 20 Mar 2026 14:21:23 +0100
> Christian Brauner <brauner@kernel.org> wrote:
>
> > > +TRACE_EVENT(coredump,
> > > +
> > > +	TP_PROTO(int sig),
> > > +
> > > +	TP_ARGS(sig),
> > > +
> > > +	TP_STRUCT__entry(
> > > +		__field(int, sig)
> > > +		__array(char, comm, TASK_COMM_LEN)
> > > +		__field(pid_t, pid)
> > > +	),
> > > +
> > > +	TP_fast_assign(
> > > +		__entry->sig = sig;
> > > +		memcpy(__entry->comm, current->comm, TASK_COMM_LEN);
> > > +		__entry->pid = current->pid;
> >
> > That's the TID as seen in the global pid namespace.
> > I assume this is what you want but worth noting.
>
> Not to mention the pid is saved in all trace events and is available for
> perf and bpf too. Even the change log showed it:
>
>              sleep-634     [036] .....   145.222206: coredump: sig=11 comm=sleep pid=634
>
>                    ^^^                                                               ^^^
>
> So it should not be included. It's duplicate and only wastes space. Now if
> you wanted to save the name space pid, that may be useful.

In my use case, I don't need the namespace pid since I'm primarily
focused on system-wide monitoring, and the global pid is sufficient
for my purposes. Thanks for the heads-up.

I'll update the patch to remove the pid field.

Thanks,
--breno