> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/traceable/agent-docs/ebpf.md). # eBPF Tracing Agent eBPF (extended Berkeley Packet Filter) is a powerful feature in the Linux kernel that allows for the safe execution of user-defined programs within the kernel space. This technology enables functionalities like packet filtering, tracing, and performance analysis without modifying kernel source code or loading custom kernel modules. ## Linux Kernel and User Space In Linux systems, the operating environment is divided into two primary spaces: * **Kernel Space**: Where the operating system's core operates with full access to hardware resources like memory, CPU, and storage. * **User Space**: Where application software runs with restricted hardware access, relying on the kernel to perform low-level operations. eBPF bridges these two spaces by allowing custom code to execute safely within the kernel, providing high-performance data processing capabilities. ## Traceable's eBPF Solution Traceable utilizes eBPF to enhance its monitoring and analysis capabilities. By attaching probes to essential kernel functions involved in network socket transactions—such as `open`, `connect`, `read`, `write`, and `close`—Traceable can collect valuable data with minimal overhead. > **Note**: Request blocking is **not** supported with eBPF Traceable agent deployment. The following diagram shows a high-level flow of Traceable's eBPF collection-based solution: *** ## Prerequisites ### System Requirements * **Linux Kernel**: The following kernel versions are supported with BTF (BPF Type Format) enabled: * **RHEL 7/CentOS 7**: Kernel version 3.10.0-1160.76 or later * **Ubuntu/Debian/RHEL 8/RHEL 9**: Kernel version 4.18 or later ### Kernel Configuration * Must be built with `CONFIG_DEBUG_INFO_BTF=y` option ```bash cat /boot/config-$(uname -r) | grep BTF ``` Look for `CONFIG_DEBUG_INFO_BTF=y` in the output ### Required Capabilities * `SYS_PTRACE` and `SYS_ADMIN` capabilities in Kubernetes * See [Required Capabilities](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/required-capabilities.md) for more details ### TLS Support eBPF tracing agent can capture TLS traffic from the following applications: * OpenSSL/BoringSSL based applications (Ruby, Python, Node.js, Nginx, Envoy) * Java applications using: * SunJSSE * IBM JSSE2 * BouncyCastle security providers * Unstripped Golang applications ### Traceable Platform Agent (TPA) Requirements * TPA endpoint * TLS configuration (enabled/disabled) * CA certificate (if TLS is enabled) *** ## Installation Guide Each [deployment architecture](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/deployment-architectures/README.md) guide includes a **Full production configuration** section with a complete example (environment, deployment name, resource/rate limits, process or pod selection, TPA HTTP/TLS, proxy, and custom attributes). See the [checklist](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/deployment-architectures/README.md#full-production-configuration-checklist). ### Version <= 1.24.2 Check [old-releases](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/old-releases/README.md) for installation instructions. Follow upgrade steps in [upgrade.md](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/upgrade.md) to move to new deployment methods in K8s environment. Below instructions are for version >= 1.25.2 ### 1. Download the Package Download the appropriate package for your platform. ### 2. Configuration Create a configuration override file using one of these references: * [Configuration Details](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/configuration.md) * [Override Configuration](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/override-config.md) * [Kubernetes MatchSelector Configuration](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/match-selectors.md) * [Default Configuration](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/default-config.md) ### 3. Installation Instructions #### Containerized Environments * [Docker](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/install-options/Docker/InstallationSteps.md) * [Amazon ECS](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/install-options/ECS/InstallationSteps.md) #### Virtual Machines * [Debian/Ubuntu](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/install-options/VM/debian/InstallationSteps.md) * [RHEL/CentOS](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/install-options/VM/rpm/InstallationSteps.md) * [Universal Installer](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/install-options/VM/package/InstallationSteps.md) #### Kubernetes * [Helm Chart](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/install-options/k8s/helm/InstallationSteps.md) * [Terraform](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/install-options/k8s/terraform/InstallationSteps.md) * [GKE Autopilot](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/install-options/GKE-autopilot/InstallationSteps.md) #### Others * [Axway with eBPF](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/install-options/axway/InstallationSteps.md) ## Troubleshooting For assistance with common issues, refer to the [Troubleshooting Guide](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/Troubleshooting.md). ## Quick links * [Deployment Architectures](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/deployment-architectures/README.md) * [VM Package and systemd](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/deployment-architectures/vm-package-systemd.md) * [VM Docker](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/deployment-architectures/vm-docker.md) * [Kubernetes DaemonSet](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/deployment-architectures/kubernetes-daemonset.md) * [AWS ECS EC2 CloudFormation](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/deployment-architectures/aws-ecs-ec2-cloudformation.md) * [Ansible Fleet](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/deployment-architectures/ansible-fleet.md) * [Puppet Fleet](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/deployment-architectures/puppet-fleet.md) * [install-options/](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/install-options/README.md) * [old-releases/](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/old-releases/README.md) * [OverrideConfig](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/override-config.md) * [Configuration](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/configuration.md) * [MatchSelectors](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/match-selectors.md) * [default-config](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/default-config.md) * [RequiredCapabilities](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/required-capabilities.md) * [Troubleshooting](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/Troubleshooting.md) * [Release Notes](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/release-notes.md) * [resources/](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/resources/README.md) ## Vulnerability Reports * [Vulnerability Reports](https://github.com/harness/harness-developer-hub/tree/main/traceable-dc-agent/agent-docs/ebpf/vulnerability-reports/README.md)