Hey y'all (especially @alessandrogario) I followed up with my team and we are on board with announcing a deprecation of the existing BPF functionality (context: discussed in office hours yesterday). We request at least 6 months from the time of the announcement so that we can work with our customers to make sure that their needs are covered. Does that work for y'all? Once there's an announcement, we will share it with our customers and develop a plan to address their needs.

I guess that means I can modify this issue https://github.com/fleetdm/fleet/issues/30639 to remove BPF functionality? It seems that @Stefano Bonicatti will be upgrading the tool chain.

Should coordinate with Stefano who does which part, thank you!

Hi @zwass, just out of curiosity, what was the reasoning for deprecating eBPF feature? thanks (even a pointer to a doc where I can read about it is fine 😉 )

It's using old technologies, and was built when there was not much else to do a better job; it's limited in terms of what it can achieve without falling apart, due to the memory/cpu requirements.

makes sense thanks!

Hi folks! Is this about deprecating the two

bpf_process_events

and

bpf_socket_events

tables?

It's using old technologies, and was built when there was not much else to do a better job

Curious to learn what's the alternative moving forward. Or is it about implementing a better use of eBPF in osquery in the future?

Hey Lucas! There is no alternative yet, as I mentioned given the lack of funding the implementation was never updated

@Lucas Rodriguez I recently had an issue made for upgrading the linux toolchain. But since @Stefano Bonicatti is taking care of that, I modified the issue to dealing with that. https://github.com/fleetdm/fleet/issues/30639

@alessandrogario just checking if the 6 month timeline seems agreeable to you?

I think so, yes! Setting up a new tracing system is pretty quick

We will take the research issue into an upcoming sprint and come up with a plan for alternatives!