trace_init_module

The trace_init_module gadget emits events when processes invoke the init_module(module_image, len, param_values) syscall to load kernel modules.

This gadget captures the module size (len) and parameters (param_values) passed during module initialization.

Requirements

• Minimum Kernel Version : 5.4

Getting started

Running the gadget:

kubectl gadget

$ kubectl gadget run ghcr.io/inspektor-gadget/gadget/trace_init_module:v0.50.0 [flags]

ig

$ sudo ig run ghcr.io/inspektor-gadget/gadget/trace_init_module:v0.50.0 [flags]

Flags

--pid

Show only events generated by processes with this pid

Default value: ""

--uid

Show only events generated by processes with this uid

Default value: ""

Example output

$ sudo ig run trace_init_module:v0.50.0
RUNTIME.CONTAINERNAME COMM  PID   TID   LEN  PARAM_VALUES
...                  insmod 1234  1234  4096 foo=bar