aquasecurity / aquasecurity/tracee
Use ring buffers for kernels >= 5.8
Open
area/ebpf
kind/feature
priority/backlog
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
Starting from kernel 5.8, the preferred way to submit events is using “ringbuf_output” - https://github.com/iovisor/bcc/blob/master/docs/reference_guide.md#4-bpf_ringbuf_output
We should use that method for kernels >= 5.8
Contributor guide
Assessment
This issue has not been assessed yet.