Hey @Zander Mackie && @Matt Uebel, any chance you can take a look at this PoC? 🙂
Only has network events, but should be a huge performance improvement compared to core (and I will add process events too in the future!)
m
Matt Uebel
04/28/2022, 8:56 PM
I'll take a look!
a
alessandrogario
04/29/2022, 2:32 PM
I have forgot to mention this but bpf needs to
1. be able to call the bpf() syscall
2. access debug symbols defined in /sys/kernel/btf/linux
so it will likely not work inside a container out of the box