eBPF Tracing Agent
eBPF (extended Berkeley Packet Filter) is a powerful feature in the Linux kernel that allows for the safe execution of user-defined programs within the kernel space. This technology enables functionalities like packet filtering, tracing, and performance analysis without modifying kernel source code or loading custom kernel modules.
Linux Kernel and User Space
In Linux systems, the operating environment is divided into two primary spaces:
Kernel Space: Where the operating system's core operates with full access to hardware resources like memory, CPU, and storage.
User Space: Where application software runs with restricted hardware access, relying on the kernel to perform low-level operations.
eBPF bridges these two spaces by allowing custom code to execute safely within the kernel, providing high-performance data processing capabilities.
Traceable's eBPF Solution
Traceable utilizes eBPF to enhance its monitoring and analysis capabilities. By attaching probes to essential kernel functions involved in network socket transactions—such as open, connect, read, write, and close—Traceable can collect valuable data with minimal overhead.
Note: Request blocking is not supported with eBPF Traceable agent deployment.
The following diagram shows a high-level flow of Traceable's eBPF collection-based solution:
Prerequisites
System Requirements
Linux Kernel: The following kernel versions are supported with BTF (BPF Type Format) enabled:
RHEL 7/CentOS 7: Kernel version 3.10.0-1160.76 or later
Ubuntu/Debian/RHEL 8/RHEL 9: Kernel version 4.18 or later
Kernel Configuration
Must be built with
CONFIG_DEBUG_INFO_BTF=yoptionLook for
CONFIG_DEBUG_INFO_BTF=yin the output
Required Capabilities
SYS_PTRACEandSYS_ADMINcapabilities in KubernetesSee Required Capabilities for more details
TLS Support
eBPF tracing agent can capture TLS traffic from the following applications:
OpenSSL/BoringSSL based applications (Ruby, Python, Node.js, Nginx, Envoy)
Java applications using:
SunJSSE
IBM JSSE2
BouncyCastle security providers
Unstripped Golang applications
Traceable Platform Agent (TPA) Requirements
TPA endpoint
TLS configuration (enabled/disabled)
CA certificate (if TLS is enabled)
Installation Guide
Each deployment architecture guide includes a Full production configuration section with a complete example (environment, deployment name, resource/rate limits, process or pod selection, TPA HTTP/TLS, proxy, and custom attributes). See the checklist.
Version <= 1.24.2
Check old-releases for installation instructions.
Follow upgrade steps in upgrade.md to move to new deployment methods in K8s environment.
Below instructions are for version >= 1.25.2
1. Download the Package
Download the appropriate package for your platform.
2. Configuration
Create a configuration override file using one of these references:
3. Installation Instructions
Containerized Environments
Virtual Machines
Kubernetes
Others
Troubleshooting
For assistance with common issues, refer to the Troubleshooting Guide.
Quick links
Vulnerability Reports
Last updated
Was this helpful?