internal/

Package ambient implements the daemon mode that monitors all process execs system-wide and traces matching process trees based on configurable rules.

Package attributes provides expression evaluation and validation for custom attributes, trace IDs, and parent span IDs.

Package bpf provides Go bindings for the eBPF process tracer.

Package bpfloader manages the lifecycle of eBPF programs and their kernel attachments.

Package config handles command-line argument parsing and OpenTelemetry configuration.

Package debuglog provides a process-wide structured debug-event sink used to diagnose daemon-mode routing decisions (session creation, descendant joins, ancestor-walk welds, trace-id mismatches, etc.).

Package envreassembler handles reassembly of environment variable data from eBPF events.

Package eventprocessor coordinates event processing and routes eBPF events to specialized handlers.

Package eventstream manages the processing of eBPF ring buffer events.

Package otel provides OpenTelemetry tracer provider initialization and management.

Package output provides formatters for converting processed events into output formats.

Package procmeta manages process metadata lifecycle.

Package reversedns provides connection enrichment by extracting network endpoints from process environment variables, command-line arguments, and runtime events.

Package timesync provides time conversion utilities for converting kernel boot-clock timestamps from eBPF events to wall-clock time.