From cf9bd0f3735653648580a94989af2b6e07eb8475 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <carter.li@eoitek.com>
Date: Thu, 22 Aug 2024 23:36:38 +0800
Subject: [PATCH] Loadavg (Linux): read `/proc/loadavg` instead of
 `/proc/uptime`

Fix #1206
---
 src/detection/loadavg/loadavg_linux.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/detection/loadavg/loadavg_linux.c b/src/detection/loadavg/loadavg_linux.c
index 47085a744..9e8b091c5 100644
--- a/src/detection/loadavg/loadavg_linux.c
+++ b/src/detection/loadavg/loadavg_linux.c
@@ -9,12 +9,12 @@ const char* ffDetectLoadavg(double result[3])
 
     // Don't use syscall for container compatibility. #620
     char buf[64];
-    ssize_t nRead = ffReadFileData("/proc/uptime", sizeof(buf) - 1, buf);
+    ssize_t nRead = ffReadFileData("/proc/loadavg", sizeof(buf) - 1, buf);
     if (nRead > 0)
     {
         buf[nRead] = '\0';
 
-        if (sscanf(buf, "%lf %lf %lf", &result[0], &result[1], &result[2]) == 3)
+        if (sscanf(buf, "%lf%lf%lf", &result[0], &result[1], &result[2]) == 3)
             return NULL;
     }