https://github.com/osquery/osquery logo
#ebpf
Title
a

alessandrogario

05/12/2021, 11:19 AM
seems like the wiki now contains version 4.11 as a requirements, but this is wrong (EDIT: the summary table is wrong, the BPF section is correct)
s

Seth Hanford

05/12/2021, 4:04 PM
Thanks, that was where my confusion came from. I’ve got it working now on a 5.10 kernel and bpf_process_events is populating.
3 Views