Also would the experimental bpf based implementation help in

Question

Also would the experimental bpf based implementation help in this regard so that we can rule out most of noise in the kernel space and not let it enter the full blown processing within osquery I would be really interested in that PS I am not using the managed audit config and letting osquery manage the audit config as we kind of need some globbing patterns in the file patterns

alessandrogario · Answer

The BPF support <https github com osquery osquery pull 6571> only implements bpf process events and bpf socket events Implementing FIM again would require additional work

Prateek Kumar Nischal · Answer

I got really interested into the bpf stuff when I came across it and then saw this PR and got even more excited about it smile Was there a significant resource utilization improvement while using bpf with the process events table if yes then that might be a good route atleast for the future

alessandrogario · Answer

You can try out the packages i uploaded in the < CADGD9ACF|ebpf> channel

alessandrogario · Answer

i will update them with the next release 4 5 1

alessandrogario · Answer

But back to memory usage depends on the hardware

alessandrogario · Answer

we have to use per cpu maps to store data

alessandrogario · Answer

it s 4 buffer storages to store strings like paths or buffers like sockaddr in of 4096 configurable slots of 4k bytes each not configurable for each cpu core

alessandrogario · Answer

plus the perf events ring buffer of 2^12 configurable bytes also per cpu core

alessandrogario · Answer

there is also an additional small map for each syscall we trace but the size is really tiny

alessandrogario · Answer

so if you have a monster machine with 64 core then it s going to use quite a lot of memory

alessandrogario · Answer

main issue is that with bpf you can t block or pause the execution forever so the best approach is to just save data without having to rely on locks

alessandrogario · Answer

so we basically use per cpu maps that basically save data like this map cpu index key = value