From f480cc4d748c8378551fe08585174c7020b0ac5e Mon Sep 17 00:00:00 2001
From: Raphael Fakhri <153192858+RaphaelFakhri@users.noreply.github.com>
Date: Mon, 19 Oct 2026 06:20:56 +0000
Subject: [PATCH] l7: parse memcached delete commands without trailing
 arguments

ParseMemcached expected a space after the key, so the common "delete <key>\r\n" form returned an empty command and the span was dropped. Fall back to the end of the line when no space follows the key.
---
 ebpftracer/l7/l7_test.go   | 8 ++++++++
 ebpftracer/l7/memcached.go | 6 +++++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/ebpftracer/l7/l7_test.go b/ebpftracer/l7/l7_test.go
index 13890aeb..6183e6c5 100644
--- a/ebpftracer/l7/l7_test.go
+++ b/ebpftracer/l7/l7_test.go
@@ -27,6 +27,14 @@ func Test_parseMemcached(t *testing.T) {
 	cmd, items = ParseMemcached(append([]byte(`gets 1111 2222 3333`), '\r', '\n'))
 	assert.Equal(t, "gets", cmd)
 	assert.Equal(t, []string{"1111", "2222", "3333"}, items)
+
+	cmd, items = ParseMemcached(append([]byte(`delete 1111`), '\r', '\n'))
+	assert.Equal(t, "delete", cmd)
+	assert.Equal(t, []string{"1111"}, items)
+
+	cmd, items = ParseMemcached(append([]byte(`delete 1111 noreply`), '\r', '\n'))
+	assert.Equal(t, "delete", cmd)
+	assert.Equal(t, []string{"1111"}, items)
 }
 
 func TestParseRedis(t *testing.T) {
diff --git a/ebpftracer/l7/memcached.go b/ebpftracer/l7/memcached.go
index 4e346a38..24bcb1d2 100644
--- a/ebpftracer/l7/memcached.go
+++ b/ebpftracer/l7/memcached.go
@@ -18,7 +18,11 @@ func ParseMemcached(payload []byte) (string, []string) {
 	command := string(cmd)
 	switch command {
 	case "set", "add", "cas", "append", "prepend", "replace", "delete", "incr", "decr", "touch":
-		if key, _, ok := bytes.Cut(rest, space); ok {
+		key, _, ok := bytes.Cut(rest, space)
+		if !ok {
+			key, _, ok = bytes.Cut(rest, crlf) // e.g., "delete <key>\r\n"
+		}
+		if ok {
 			return command, []string{string(key)}
 		}
 	case "gat", "gats":