Hello,
I am trying to configure osquery to get data into bpf_process_events and bpf_socket_events. OS is Ubuntu 18.04. I added to osquery.conf the lines:
“disable_events” : “false”,
“enable_bpf_events” : “true”
Still, get those messages in
osqueryd.INFO:
I0509 09
1444.464463 3622 eventfactory.cpp:156] Event publisher not enabled: BPFEventPublisher: Failed to create the function tracer: The ‘enter’ program could not be loaded: Failed to open the Linux kernel version header: /usr/include/linux/version.h
Any hint?