< maestretti> why ebpf and not static tracepoints for execve osquery #ebpf

<@U136R8Y1E> why ebpf and not static tracepoints f...

b0l

07/30/2018, 5:59 PM

@maestretti why ebpf and not static tracepoints for execve?

maestretti

07/30/2018, 6:15 PM

Static tracepoint is def the right place to target, so is the question why eBPF instead of perf?