fix(csysdig): don't let syslog parse enter events

Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>

Author: therealbobo

userspace/sysdig/csysdig.cpp

@@ -283,7 +283,17 @@ captureinfo do_inspect(sinsp* inspector,
 
         syslog_decoder->reset();
 		res = inspector->next(&ev);
-        syslog_decoder->parse(ev);
+        if (ev)
+        {
+            const uint16_t etype = ev->get_scap_evt()->type;
+            if (etype == PPME_SYSCALL_WRITE_X || etype == PPME_SYSCALL_WRITEV_X ||
+                etype == PPME_SYSCALL_PWRITE_X || etype == PPME_SYSCALL_PWRITEV_X ||
+                etype == PPME_SOCKET_SEND_X || etype == PPME_SOCKET_SENDTO_X ||
+                etype == PPME_SOCKET_SENDMSG_X || etype == PPME_SOCKET_SENDMMSG_X)
+            {
+                syslog_decoder->parse(ev);
+            }
+        }
 
 		if(res == SCAP_TIMEOUT || res == SCAP_FILTERED_EVENT)
 		{

userspace/sysdig/utils/sinsp_syslog.cpp

@@ -76,30 +76,44 @@ std::string sinsp_syslog_decoder::get_info_line() const {
 }
 
 void sinsp_syslog_decoder::parse(sinsp_evt* evt) {
-	if(!evt || !evt->get_fd_info()) {
+	const sinsp_evt_param *parinfo;
+	int64_t retval;
+	ppm_event_flags eflags = evt->get_info_flags();
+	uint16_t etype = evt->get_scap_evt()->type;
+
+	if((etype == PPME_SOCKET_SENDMMSG_X || etype == PPME_SOCKET_RECVMMSG_X) &&
+	   evt->get_num_params() == 0) {
 		return;
 	}
-
+	//
+	// Extract the return value
+	//
+	retval = evt->get_syscall_return_value();
+
+    if (retval < 0) {
+        return;
+    }
+    
 	// Check if this is a syslog fd
-	if(!evt->get_fd_info()->is_syslog()) {
+	if(evt->get_fd_info() == nullptr || !evt->get_fd_info()->is_syslog()) {
 		return;
 	}
 
+    if(!(eflags & EF_READS_FROM_FD)) {
+        return;
+    }
+
 	// Extract the data buffer based on event type
-	uint16_t etype = evt->get_type();
-	const sinsp_evt_param* parinfo = nullptr;
+	parinfo = nullptr;
 
 	// Determine which parameter contains the data based on event type
-	if(etype == PPME_SOCKET_SENDMMSG_X) {
-		parinfo = evt->get_param(2);
-	} else if(etype == PPME_SYSCALL_READV_X || etype == PPME_SYSCALL_PREADV_X ||
-	          etype == PPME_SOCKET_RECVMSG_X) {
-		parinfo = evt->get_param(2);
-	} else if(etype == PPME_SOCKET_RECVMMSG_X) {
-		parinfo = evt->get_param(3);
-	} else {
-		parinfo = evt->get_param(1);
-	}
+    if(etype == PPME_SOCKET_RECVMSG_X) {
+        parinfo = evt->get_param(2);
+    } else if(etype == PPME_SOCKET_RECVMMSG_X || etype == PPME_SOCKET_SENDMMSG_X) {
+        parinfo = evt->get_param(3);
+    } else {
+        parinfo = evt->get_param(1);
+    }
 
 	if(parinfo) {
 		const char* data = parinfo->m_val;