pid=-1 in few events #3526
Description
Describe the bug
We follow this using dup syscalls to detect reverse shell, and it works perfect. Until recently we find a few pid=-1 trigger the alert like below, while during time we don't find any dropped events/syscalls. As we can see, except the fd information, all other information is missing.
Warning Redirect stdout/stdin to net ipvx (user=<NA> user_id=4294967295 user_loginname=<NA> user_loginuid=-1 program={*{ <NA> }*} parent={*{ <NA> }*} gparent=<NA> ggparent=<NA> gggparent=<NA> ggggparent=<NA> gggggparent=<NA> g6parent=<NA> g7parent=<NA> pid=-1 ppid=<NA> container_name=host container_id=host image=<NA> file=10.150.211.130:46444->3.5.155.125:443 fd.num=1 fd.type=ipv4 fd.l4proto=udp fd.sip=3.5.155.125 fd.cip=10.150.211.130 fd.sport=443 command={*{ <NA> }*} pcmdline={*{ <NA> }*})
Environment
This happens in either faco version 0.37/0.39/0.40, and either on legacy ebpf or modern bpf mode.
The OS: amazon Linux 2 (5.10.217-205.860.amzn2.aarch64)