Hello, I am trying to configure osquery to get da...
# general
t
Hello, I am trying to configure osquery to get data into bpf_process_events and bpf_socket_events. OS is Ubuntu 18.04. I added to osquery.conf the lines: “disable_events” : “false”, “enable_bpf_events” : “true” Still, get those messages in osqueryd.INFO: I0509 091444.464463 3622 eventfactory.cpp:156] Event publisher not enabled: BPFEventPublisher: Failed to create the function tracer: The ‘enter’ program could not be loaded: Failed to open the Linux kernel version header: /usr/include/linux/version.h Any hint?