BPFEventPublisher: Failed to create the perf event array: Failed to create the perf BPF
Trying to get osquery process events using bpf_process_events but getting BPFEventPublisher: Failed to create the perf event array: Failed to create the perf BPF error.
Cpu possible and online values are -
sys/devices/system/cpu/possible
0-127
/sys/devices/system/cpu/online
0-1
Tried by adding these two flags as well.
--bpf_buffer_storage_size=512
--bpf_perf_event_array_exp=10
Still getting same error.
Further tried to disable CPU Hot Plug. It worked. But I want it to worked with CPU Hot...