I am following bcc Tutorial and trying to execute the
sudo trace-bpfcc 'sys_execve "%s", arg1'
The command fails with an error:
cannot attach kprobe, probe entry may not exist Failed to attach BPF program b'probe_sys_execve_1' to kprobe b'sys_execve'
While searching the web, I found that such an error can occur if the symbol
__x64_sys_execve is missing in
/proc/kallsyms, but I have one there.
I don't have any kernel development experience at all, what do I need to do to fix this issue?
My distro is Ubuntu 20