diff --git a/bugtool/cmd/configuration.go b/bugtool/cmd/configuration.go
index <HASH>..<HASH> 100644
--- a/bugtool/cmd/configuration.go
+++ b/bugtool/cmd/configuration.go
@@ -77,7 +77,7 @@ func defaultCommands(confDir string, cmdDir string, k8sPods []string) []string {
 		"ip -6 route show table 200",
 		// xfrm
 		"ip xfrm policy",
-		"ip -s xfrm state",
+		"ip -s xfrm state | awk '!/auth|enc/'",
 		// gops
 		fmt.Sprintf("gops memstats $(pidof %s)", components.CiliumAgentName),
 		fmt.Sprintf("gops stack $(pidof %s)", components.CiliumAgentName),
cilium: scrub keys from bugtool xfrm

Remove keys from xfrm debug output. We want the state output to
identify any issues with xfrm setup, the output has the stats.
We don't however want to record any keys.

Fixes: <I>b<I>ee<I> ("cilium: bugtool add xfrm details")