Capture statuses

Every captured field, a string, a buffer or a structure, carries a status that says how completely the recorder obtained it. Syscall Trace shows it next to the field, and you can filter on it with args.<argument>.status (see Syscall Trace filter).

The recorder copies user memory without faulting pages in, so it never changes the program’s behavior. That is why some fields cannot be complete. A missing value is not an empty one.

A complete capture: the captured bytes equal the logical length. Antinomie 0.8.0, a recorded run.

Since 0.7.1, with a base built for 0.7.1 or later, an input that was NOT_RESIDENT at the call’s entry is read again when the call returns. The field then takes the place of the NOT_RESIDENT one, with an at exit tag whose tooltip says the bytes are what memory held after the call (another thread could have changed them meanwhile). After a successful exec, the path, arguments and environment come from the kernel’s copy and the new program’s stack, tagged kernel copy. Such a call is no longer incomplete.

The six you will meet most

Status	In plain words	What to do
COMPLETE	All the bytes were captured	Nothing; the value is whole
NOT_RESIDENT	The memory is mapped and readable but the page had not been loaded yet, so nothing could be copied without faulting it in. The kernel loaded it for the call itself.	The value is unknown, not empty. Look at later calls, or check the strings the program passed elsewhere.
COPY_FAULT	The bytes could not be read: the address was not mapped, not readable, or the recorder could not safely check	The value is unknown. A call with a bad pointer may legitimately have failed with EFAULT.
INVALID_EXTENT	The length the program gave was invalid or above the kernel’s limit, so no bytes were copied	The program passed a bad size. Read its declared length instead.
ADDRESS_ONLY	Only the address and length were recorded, never the contents	Expected for another process’s memory, such as ptrace or process_vm_readv targets
NO_DECODER	The recorder has no rule for this argument, selector or option	The value may be recorded raw; see Known gaps

NOT_RESIDENT, COPY_FAULT, INVALID_EXTENT and NO_DECODER mark the call as incomplete. COMPLETE, ADDRESS_ONLY and a null or not-written field do not. Copy faults, schema gaps and context failures are also counted under More health details in Summary; they are diagnostics and are not added to the packet-loss counters.

The other statuses

Status	Meaning
Unknown extent	The length could not be determined
Null pointer	The argument was a null pointer
Not observed asynchronously	The kernel reads this later, in a context where user memory could not be read safely (see Async observations)
Resource exhausted	The recorder ran out of staging space for this field
Aborted on loss	The capture was abandoned because records were being lost
Context missing	The context needed to read the value was not available
Not written	An argument the kernel ignores and never writes, such as the cache argument of getcpu. Nothing is missing, and the call is not marked incomplete.

A note on timing

Memory can change while it is being read. A recorded buffer is what the memory held when the kernel copied it, which is not an atomic snapshot of the program.