en/tutorials/4-opensnoop/

[giscus[bot]]

en/tutorials/4-opensnoop/

Unlock the potential of eBPF

https://eunomia.dev/en/tutorials/4-opensnoop/

[zts-dmitchell]

I'm continually confused by return false and return 0:

int tracepoint__syscalls__sys_enter_openat(struct trace_event_raw_sys_enter* ctx)
...
if (pid_target && pid_target != pid)
return false;

// Use bpf_printk to print the process information
bpf_printk("Process ID: %d enter sys openat\n", pid);
return 0;

Why not just return 0 instead of return false?

[Officeyutong]

0 and false are the same when converted to int