sensor

package
v0.7.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 9, 2026 License: Apache-2.0 Imports: 23 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Run

func Run(out io.Writer) error

Run loads the eBPF probes (exec/connect/openat), reads events from the ring buffer, enriches each with a container id derived from the task's cgroup, and writes one normalized telemetry event per line (JSONL) to out. It blocks until SIGINT/SIGTERM. Requires root or CAP_BPF + CAP_PERFMON.

func RunWithOptions added in v0.3.0

func RunWithOptions(out io.Writer, opts Options) error

RunWithOptions is Run with optional extra probes (see Options).

Types

type Options added in v0.3.0

type Options struct {
	// SSLLib, when set, attaches SSL_write/read and SSL_write_ex/read_ex uprobes
	// to this libssl path to capture TLS plaintext zero-instrumentation.
	SSLLib string
	// LibcLib overrides the libc path for the getaddrinfo DNS uprobe; empty =
	// auto-detect the common system libc paths.
	LibcLib string
	// GoTLSBin, when set, attaches a uprobe to crypto/tls.(*Conn).Write in this Go
	// binary to capture the request/prompt plaintext for Go agents, which use Go's
	// own TLS (no libssl for the SSLLib uprobes to hook). Best-effort: a stripped
	// binary (-ldflags "-s -w") has no symbol to attach.
	GoTLSBin string
	// OnReady, when set, is called exactly once after every probe has attached
	// and the ring buffer reader is open -- i.e. the sensor is genuinely capturing
	// and the caller may safely start the workload it wants observed. Supervisors
	// (launch) gate their exec on this to avoid racing a fast agent past a
	// not-yet-attached sensor. Callable from a goroutine; keep it non-blocking.
	OnReady func()
}

Options configures optional sensor probes beyond the always-on syscall set.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL