ebpf

package

Go to main page

Versions in this module

v0

v0.22.5

Dec 10, 2024

v0.22.4

Nov 11, 2024

v0.22.3

Oct 31, 2024

v0.22.2

Sep 24, 2024

v0.22.1

Sep 10, 2024

v0.22.0

Aug 27, 2024

v0.22.0-rc

Aug 23, 2024

v0.21.0

Jun 20, 2024

Changes in this version

type BPFLogType

+ const BPFLogIDHidKerMod

v0.21.0-rc

Apr 26, 2024

v0.20.0

Feb 8, 2024

Changes in this version

+ const ConfigMap

type Config

+ CgroupV1Hid uint32

+ Options uint32

+ PoliciesConfig policy.PoliciesConfig

+ PoliciesVersion uint16

+ TraceePid uint32

+ func (c *Config) UpdateBPF(bpfModule *bpf.Module) error

type Tracee

+ func (t *Tracee) Engine() *engine.Engine

v0.20.0-rc

Feb 8, 2024

v0.19.0

Nov 3, 2023

v0.19.0-rc

Nov 3, 2023

v0.18.1

Oct 18, 2023

v0.18.0

Oct 6, 2023

Changes in this version

type Tracee

+ func (t *Tracee) DisableEvent(eventName string) error

+ func (t *Tracee) DisableRule(policyNames []string, ruleId string) error

+ func (t *Tracee) EnableEvent(eventName string) error

+ func (t *Tracee) EnableRule(policyNames []string, ruleId string) error

+ func (t *Tracee) Subscribe(policyNames []string) (*streams.Stream, error)

+ func (t *Tracee) SubscribeAll() *streams.Stream

+ func (t *Tracee) Unsubscribe(s *streams.Stream)

v0.18.0-rc

Sep 28, 2023

v0.17.1

Aug 10, 2023

v0.17.0

Jul 28, 2023

Changes in this version

type Tracee

+ func (t *Tracee) PrepareBuiltinDataSources() []detect.DataSource

v0.17.0-rc

Jul 25, 2023

v0.16.2

Jul 20, 2023

v0.16.1

Jul 12, 2023

v0.16.0

Jun 29, 2023

Changes in this version

type InitValues

+ Kallsyms bool

v0.16.0-rc

Jun 27, 2023

v0.15.1

Jun 13, 2023

v0.15.0

Jun 6, 2023

Changes in this version

type CaptureConfig

+ FileRead FileCaptureConfig

+ type FileCaptureConfig struct

+ Capture bool

+ PathFilter []string

+ TypeFilter FileCaptureType

+ type FileCaptureType uint

+ const CapturePipeFiles

+ const CaptureRegularFiles

+ const CaptureSocketFiles

+ const CaptureStderrFiles

+ const CaptureStdinFiles

+ const CaptureStdoutFiles

type Tracee

+ func (t *Tracee) AddReadyCallback(f func(ctx gocontext.Context))

v0.14.2

May 12, 2023

v0.14.1

May 10, 2023

Changes in this version

type Config

+ MetricsEnabled bool

type Tracee

+ OutDir *os.File

v0.14.0

May 3, 2023

v0.13.1

Apr 6, 2023

v0.13.0

Mar 31, 2023

Changes in this version

type CaptureConfig

+ Bpf bool

type Config

+ Policies *policy.Policies

v0.12.0

Mar 3, 2023

v0.11.1

Feb 15, 2023

v0.11.0

Jan 31, 2023

Changes in this version

+ const BPFMaxLogFileLen

+ const MaxFilterScopes

+ const ProcInfoMap

+ func FilterScopeAlreadyExists(scope *FilterScope, id int) error

+ func FilterScopeNilError() error

+ func FilterScopeNotFoundError(idx int) error

+ func FilterScopesMaxExceededError() error

+ func FilterScopesOutOfRangeError(idx int) error

+ func LoadKallsymsValues(ksymsTable helpers.KernelSymbolTable, ksymbols []string) map[string]*helpers.KernelSymbol

+ func SendKsymbolsToMap(bpfKsymsMap *libbpfgo.BPFMap, ksymbols map[string]*helpers.KernelSymbol) error

+ func ValidateKsymbolsTable(ksyms helpers.KernelSymbolTable) bool

+ type BPFLog struct

+ func (b *BPFLog) Decode(rawBuffer []byte) error

+ func (b BPFLog) CPU() uint32

+ func (b BPFLog) Count() uint32

+ func (b BPFLog) Error() string

+ func (b BPFLog) File() []byte

+ func (b BPFLog) FileAsString() string

+ func (b BPFLog) ID() uint32

+ func (b BPFLog) Line() uint32

+ func (b BPFLog) LogLevel() logger.Level

+ func (b BPFLog) Return() int64

+ func (b BPFLog) Size() int

+ func (b BPFLog) Type() BPFLogType

+ type BPFLogType uint32

+ const BPFLogIDGetCurrentComm

+ const BPFLogIDInitContext

+ const BPFLogIDMapDeleteElem

+ const BPFLogIDMapLookupElem

+ const BPFLogIDMapUpdateElem

+ const BPFLogIDMemRead

+ const BPFLogIDTailCall

+ const BPFLogIDUnspec

+ func (b BPFLogType) String() string

type CaptureConfig

+ Net pcaps.Config

type Config

+ FilterScopes *FilterScopes

+ type FilterScope struct

+ ArgFilter *filters.ArgFilter

+ BinaryFilter *filters.BPFBinaryFilter

+ CommFilter *filters.BPFStringFilter

+ ContFilter *filters.BoolFilter

+ ContIDFilter *filters.ContainerFilter

+ ContextFilter *filters.ContextFilter

+ EventsToTrace map[events.ID]string

+ Follow bool

+ ID int

+ MntNSFilter *filters.BPFUIntFilter[uint64]

+ NewContFilter *filters.BoolFilter

+ NewPidFilter *filters.BoolFilter

+ PIDFilter *filters.BPFUIntFilter[uint32]

+ PidNSFilter *filters.BPFUIntFilter[uint64]

+ ProcessTreeFilter *filters.ProcessTreeFilter

+ RetFilter *filters.RetFilter

+ UIDFilter *filters.BPFUIntFilter[uint32]

+ UTSFilter *filters.BPFStringFilter

+ func NewFilterScope() *FilterScope

+ func (fs FilterScope) ContainerFilterEnabled() bool

+ type FilterScopes struct

+ func NewFilterScopes() *FilterScopes

+ func (fs *FilterScopes) Add(scope *FilterScope) error

+ func (fs *FilterScopes) Delete(id int) error

+ func (fs *FilterScopes) Set(id int, scope *FilterScope) error

+ func (fs FilterScopes) ContainerFilterEnabled() uint64

+ func (fs FilterScopes) Count() int

+ func (fs FilterScopes) Lookup(id int) (*FilterScope, error)

+ func (fs FilterScopes) Map() map[*FilterScope]int

+ func (fs FilterScopes) PIDFilterMax() uint64

+ func (fs FilterScopes) PIDFilterMin() uint64

+ func (fs FilterScopes) PIDFilterableInUserSpace() bool

+ func (fs FilterScopes) UIDFilterMax() uint64

+ func (fs FilterScopes) UIDFilterMin() uint64

+ func (fs FilterScopes) UIDFilterableInUserSpace() bool

+ func (fs FilterScopes) UserSpaceMap() map[*FilterScope]int

type Tracee

+ func (t *Tracee) NewKernelSymbols() error

+ func (t *Tracee) RegisterEventDerivation(deriveFrom events.ID, deriveTo events.ID, deriveCondition func() bool, ...) error

+ func (t *Tracee) RegisterEventProcessor(id events.ID, proc func(evt *trace.Event) error) error

+ func (t *Tracee) UpdateBPFKsymbolsMap() error

+ func (t *Tracee) UpdateKallsyms() error

+ func (t *Tracee) UpdateKernelSymbols() error

v0.10.0

Dec 16, 2022

Changes in this version

+ const BPFMaxErrFileLen

+ const BinaryFilterMap

+ func FindingToEvent(f detect.Finding) (*trace.Event, error)

+ type BPFError struct

+ func (b *BPFError) Decode(rawBuffer []byte) error

+ func (b BPFError) CPU() uint32

+ func (b BPFError) Count() uint32

+ func (b BPFError) Error() string

+ func (b BPFError) File() []byte

+ func (b BPFError) FileAsString() string

+ func (b BPFError) ID() uint32

+ func (b BPFError) Line() uint32

+ func (b BPFError) LogLevel() logger.Level

+ func (b BPFError) Return() int64

+ func (b BPFError) Size() int

+ func (b BPFError) Type() BPFErrorType

+ type BPFErrorType uint32

+ const BPFErrGetCurrentComm

+ const BPFErrInitContext

+ const BPFErrMapDeleteElem

+ const BPFErrMapLookupElem

+ const BPFErrMapUpdateElem

+ const BPFErrTailCall

+ const BPFErrUnspec

+ func (b BPFErrorType) String() string

type Config

+ EngineConfig engine.Config

type Filter

+ BinaryFilter *filters.BPFStringFilter

+ ContextFilter *filters.ContextFilter

v0.9.3

Nov 3, 2022

v0.9.2

Oct 25, 2022

v0.9.1

Oct 24, 2022

v0.9.0

Oct 21, 2022

Changes in this version

+ const CgroupIdFilterMap

+ const CommFilterMap

+ const ContIdFilter

+ const MntNSFilterMap

+ const PIDFilterMap

+ const PidNSFilterMap

+ const ProcessTreeFilterMap

+ const UIDFilterMap

+ const UTSFilterMap

+ type CapabilitiesConfig struct

+ AddCaps []string

+ BypassCaps bool

+ DropCaps []string

type Config

+ Capabilities *CapabilitiesConfig

v0.8.3

Sep 19, 2022

Changes in this version

type Tracee

+ func (t *Tracee) GetTailCalls() ([]events.TailCall, error)

v0.8.2

Sep 6, 2022

Changes in this version

type OutputConfig

+ ParseArgumentsFDs bool

type Tracee

+ FDArgPathMap *bpf.BPFMap

v0.8.1

Aug 11, 2022

Changes in this version

+ type InitValues struct

+ type NetIfaces struct

+ Ifaces []string

+ func (filter *NetIfaces) Parse(operatorAndValues string) error

+ func (ifaces *NetIfaces) Find(iface string) (int, bool)

+ func (ifaces *NetIfaces) Interfaces() []string

type Tracee

+ func (t *Tracee) Init() error

+ func (t *Tracee) Running() bool

v0.8.0

Jul 14, 2022

Changes in this version

+ const IoctlFetchSyscalls

+ const IoctlHookedSeqOps

+ const Iterate

+ const IterateShared

+ const StructFopsPointer

+ func GetCaptureEventsList(cfg *Config) map[events.ID]eventConfig

+ func GetEssentialEventsList(cfg *Config) map[events.ID]eventConfig

+ func MatchFilter(filters []string, argValStr string) bool

+ func ParseIface(operatorAndValues string, ifacesList *[]string) error

type Config

+ ContainersEnrich bool

+ OSInfo *helpers.OSInfo

+ Sockets runtime.Sockets

type Filter

+ NetFilter *IfaceFilter

+ type IfaceFilter struct

+ InterfacesToTrace []string

+ func (filter *IfaceFilter) Parse(operatorAndValues string) error

+ type RequiredInitValues struct

v0.8.0-rc-2

Jul 14, 2022

v0.8.0-rc-1

Jul 3, 2022

v0.7.0

Mar 28, 2022

Changes in this version

+ const Accept4EventID — darwin/amd64, linux/amd64, windows/amd64

+ const AcceptEventID — darwin/amd64, linux/amd64, windows/amd64

+ const AccessEventID — darwin/amd64, linux/amd64, windows/amd64

+ const AcctEventID — darwin/amd64, linux/amd64, windows/amd64

+ const AddKeyEventID — darwin/amd64, linux/amd64, windows/amd64

+ const AdjtimexEventID — darwin/amd64, linux/amd64, windows/amd64

+ const AfsEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Afs_syscallEventID — darwin/amd64, linux/amd64, windows/amd64

+ const AlarmEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ArchPrctlEventID — darwin/amd64, linux/amd64, windows/amd64

+ const BdflushEventID — darwin/amd64, linux/amd64, windows/amd64

+ const BindEventID — darwin/amd64, linux/amd64, windows/amd64

+ const BpfEventID — darwin/amd64, linux/amd64, windows/amd64

+ const BreakEventID — darwin/amd64, linux/amd64, windows/amd64

+ const BrkEventID — darwin/amd64, linux/amd64, windows/amd64

+ const CapCapableEventID

+ const CapgetEventID — darwin/amd64, linux/amd64, windows/amd64

+ const CapsetEventID — darwin/amd64, linux/amd64, windows/amd64

+ const CgroupAttachTaskEventID

+ const CgroupMkdirEventID

+ const CgroupRmdirEventID

+ const ChdirEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ChmodEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Chown16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const ChownEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ChrootEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ClockAdjtime64EventID — darwin/amd64, linux/amd64, windows/amd64

+ const ClockAdjtimeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ClockGetresEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ClockGetresTime32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const ClockGettime32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const ClockGettimeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ClockNanosleepEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ClockNanosleepTime32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const ClockSettime32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const ClockSettimeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Clone3EventID — darwin/amd64, linux/amd64, windows/amd64

+ const CloneEventID — darwin/amd64, linux/amd64, windows/amd64

+ const CloseEventID — darwin/amd64, linux/amd64, windows/amd64

+ const CloseRangeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const CommitCredsEventID

+ const ConnectEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ContainerCreateEventID

+ const ContainerRemoveEventID

+ const CopyFileRangeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const CreatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const CreateModuleEventID — darwin/amd64, linux/amd64, windows/amd64

+ const DebugNetInetSockSetState

+ const DebugNetSecurityBind

+ const DebugNetTcpConnect

+ const DebugNetUdpDestroySock

+ const DebugNetUdpDisconnect

+ const DebugNetUdpSendmsg

+ const DebugNetUdpV6DestroySock

+ const DeleteModuleEventID — darwin/amd64, linux/amd64, windows/amd64

+ const DoExitEventID

+ const Dup2EventID — darwin/amd64, linux/amd64, windows/amd64

+ const Dup3EventID — darwin/amd64, linux/amd64, windows/amd64

+ const DupEventID — darwin/amd64, linux/amd64, windows/amd64

+ const EpollCreate1EventID — darwin/amd64, linux/amd64, windows/amd64

+ const EpollCreateEventID — darwin/amd64, linux/amd64, windows/amd64

+ const EpollCtlEventID — darwin/amd64, linux/amd64, windows/amd64

+ const EpollCtlOldEventID — darwin/amd64, linux/amd64, windows/amd64

+ const EpollPwait2EventID — darwin/amd64, linux/amd64, windows/amd64

+ const EpollPwaitEventID — darwin/amd64, linux/amd64, windows/amd64

+ const EpollWaitEventID — darwin/amd64, linux/amd64, windows/amd64

+ const EpollWaitOldEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Eventfd2EventID — darwin/amd64, linux/amd64, windows/amd64

+ const EventfdEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ExecveEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ExecveatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ExistingContainerEventID

+ const ExitEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ExitGroupEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Faccessat2EventID — darwin/amd64, linux/amd64, windows/amd64

+ const FaccessatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Fadvise64EventID — darwin/amd64, linux/amd64, windows/amd64

+ const Fadvise64_64EventID — darwin/amd64, linux/amd64, windows/amd64

+ const FallocateEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FanotifyInitEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FanotifyMarkEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FchdirEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FchmodEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FchmodatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Fchown16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const FchownEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FchownatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Fcntl64EventID — darwin/amd64, linux/amd64, windows/amd64

+ const FcntlEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FdatasyncEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FgetxattrEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FinitModuleEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FlistxattrEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FlockEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ForkEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FremovexattrEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FsconfigEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FsetxattrEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FsmountEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FsopenEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FspickEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Fstat64EventID — darwin/amd64, linux/amd64, windows/amd64

+ const FstatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Fstatfs64EventID — darwin/amd64, linux/amd64, windows/amd64

+ const FstatfsEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FsyncEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FtimeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Ftruncate64EventID — darwin/amd64, linux/amd64, windows/amd64

+ const FtruncateEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FutexEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FutexTime32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const FutimesatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetKernelSymsEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetMempolicyEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetRobustListEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetThreadAreaEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetcpuEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetcwdEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Getdents64EventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetdentsEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Getegid16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetegidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Geteuid16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const GeteuidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Getgid16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetgidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Getgroups16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetgroupsEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetitimerEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetpeernameEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetpgidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetpgrpEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetpidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetpmsgEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetppidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetpriorityEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetrandomEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Getresgid16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetresgidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Getresuid16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetresuidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetrlimitEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetrusageEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetsidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetsocknameEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetsockoptEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GettidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GettimeofdayEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Getuid16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetuidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GetxattrEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GreaterNotSetInt

+ const GreaterNotSetUint

+ const GttyEventID — darwin/amd64, linux/amd64, windows/amd64

+ const HiddenInodesEventID

+ const IdleEventID — darwin/amd64, linux/amd64, windows/amd64

+ const InitModuleEventID — darwin/amd64, linux/amd64, windows/amd64

+ const InitNamespacesEventID

+ const InitProcNsDir

+ const InotifyAddWatchEventID — darwin/amd64, linux/amd64, windows/amd64

+ const InotifyInit1EventID — darwin/amd64, linux/amd64, windows/amd64

+ const InotifyInitEventID — darwin/amd64, linux/amd64, windows/amd64

+ const InotifyRmWatchEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IoCancelEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IoDestroyEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IoGeteventsEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IoPgeteventsEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IoPgeteventsTime32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const IoSetupEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IoSubmitEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IoUringEnterEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IoUringRegisterEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IoUringSetupEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IoctlEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IopermEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IoplEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IoprioGetEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IoprioSetEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IpcEventID — darwin/amd64, linux/amd64, windows/amd64

+ const KcmpEventID — darwin/amd64, linux/amd64, windows/amd64

+ const KexecFileLoadEventID — darwin/amd64, linux/amd64, windows/amd64

+ const KexecLoadEventID — darwin/amd64, linux/amd64, windows/amd64

+ const KeyctlEventID — darwin/amd64, linux/amd64, windows/amd64

+ const KillEventID — darwin/amd64, linux/amd64, windows/amd64

+ const LandlockAddRuleEventID — darwin/amd64, linux/amd64, windows/amd64

+ const LandlockCreateRulesetEventID — darwin/amd64, linux/amd64, windows/amd64

+ const LandloclRestrictSetEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Lchown16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const LchownEventID — darwin/amd64, linux/amd64, windows/amd64

+ const LessNotSetInt

+ const LessNotSetUint

+ const LgetxattrEventID — darwin/amd64, linux/amd64, windows/amd64

+ const LinkEventID — darwin/amd64, linux/amd64, windows/amd64

+ const LinkatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ListenEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ListxattrEventID — darwin/amd64, linux/amd64, windows/amd64

+ const LlistxattrEventID — darwin/amd64, linux/amd64, windows/amd64

+ const LlseekEventID — darwin/amd64, linux/amd64, windows/amd64

+ const LockEventID — darwin/amd64, linux/amd64, windows/amd64

+ const LookupDcookieEventID — darwin/amd64, linux/amd64, windows/amd64

+ const LremovexattrEventID — darwin/amd64, linux/amd64, windows/amd64

+ const LseekEventID — darwin/amd64, linux/amd64, windows/amd64

+ const LsetxattrEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Lstat64EventID — darwin/amd64, linux/amd64, windows/amd64

+ const LstatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MadviseEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MagicWriteEventID

+ const MaxCommonEventID

+ const MaxUserSpaceEventID

+ const MbindEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MemProtAlertEventID

+ const MembarrierEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MemfdCreateEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MemfdSecretEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MigratePagesEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MincoreEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MkdirEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MkdiratEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MknodEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MknodatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Mlock2EventID — darwin/amd64, linux/amd64, windows/amd64

+ const MlockEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MlockallEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Mmap2EventID — darwin/amd64, linux/amd64, windows/amd64

+ const MmapEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ModifyLdtEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MountEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MountSetattEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MoveMountEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MovePagesEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MprotectEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MpxEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MqGetsetattrEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MqNotifyEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MqOpenEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MqTimedreceiveEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MqTimedreceiveTime32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const MqTimedsendEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MqTimedsendTime32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const MqUnlinkEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MremapEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MsgctlEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MsggetEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MsgrcvEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MsgsndEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MsyncEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MunlockEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MunlockallEventID — darwin/amd64, linux/amd64, windows/amd64

+ const MunmapEventID — darwin/amd64, linux/amd64, windows/amd64

+ const NameToHandleAtEventID — darwin/amd64, linux/amd64, windows/amd64

+ const NanosleepEventID — darwin/amd64, linux/amd64, windows/amd64

+ const NetPacket

+ const NewfstatatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const NfsservctlEventID — darwin/amd64, linux/amd64, windows/amd64

+ const NiceEventID — darwin/amd64, linux/amd64, windows/amd64

+ const OldGetrlimitEventID — darwin/amd64, linux/amd64, windows/amd64

+ const OldSelectEventID — darwin/amd64, linux/amd64, windows/amd64

+ const OldfstatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const OldlstatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const OldoldunameEventID — darwin/amd64, linux/amd64, windows/amd64

+ const OldstatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const OldunameEventID — darwin/amd64, linux/amd64, windows/amd64

+ const OpenByHandleAtEventID — darwin/amd64, linux/amd64, windows/amd64

+ const OpenEventID — darwin/amd64, linux/amd64, windows/amd64

+ const OpenTreeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Openat2EventID — darwin/amd64, linux/amd64, windows/amd64

+ const OpenatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const PauseEventID — darwin/amd64, linux/amd64, windows/amd64

+ const PerfEventOpenEventID — darwin/amd64, linux/amd64, windows/amd64

+ const PersonalityEventID — darwin/amd64, linux/amd64, windows/amd64

+ const PidfdGetfdEventID — darwin/amd64, linux/amd64, windows/amd64

+ const PidfdOpenEventID — darwin/amd64, linux/amd64, windows/amd64

+ const PidfdSendSignalEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Pipe2EventID — darwin/amd64, linux/amd64, windows/amd64

+ const PipeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const PivotRootEventID — darwin/amd64, linux/amd64, windows/amd64

+ const PkeyAllocEventID — darwin/amd64, linux/amd64, windows/amd64

+ const PkeyFreeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const PkeyMprotectEventID — darwin/amd64, linux/amd64, windows/amd64

+ const PollEventID — darwin/amd64, linux/amd64, windows/amd64

+ const PpollEventID — darwin/amd64, linux/amd64, windows/amd64

+ const PpollTime32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const PrctlEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Pread64EventID — darwin/amd64, linux/amd64, windows/amd64

+ const Preadv2EventID — darwin/amd64, linux/amd64, windows/amd64

+ const PreadvEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Prlimit64EventID — darwin/amd64, linux/amd64, windows/amd64

+ const ProcessMadviseEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ProcessMreleaseEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ProcessVmReadvEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ProcessVmWritevEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ProfEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ProfilEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Pselect6EventID — darwin/amd64, linux/amd64, windows/amd64

+ const Pselect6Time32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const PtraceEventID — darwin/amd64, linux/amd64, windows/amd64

+ const PutpmsgEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Pwrite64EventID — darwin/amd64, linux/amd64, windows/amd64

+ const Pwritev2EventID — darwin/amd64, linux/amd64, windows/amd64

+ const PwritevEventID — darwin/amd64, linux/amd64, windows/amd64

+ const QueryModuleEventID — darwin/amd64, linux/amd64, windows/amd64

+ const QuotactlEventID — darwin/amd64, linux/amd64, windows/amd64

+ const QuotactlFdEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ReadEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ReadaheadEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ReaddirEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ReadlinkEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ReadlinkatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ReadvEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RebootEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RecvfromEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RecvmmsgEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RecvmmsgTime32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const RecvmsgEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RemapFilePagesEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RemovexattrEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RenameEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Renameat2EventID — darwin/amd64, linux/amd64, windows/amd64

+ const RenameatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RequestKeyEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RestartSyscallEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RmdirEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RseqEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RtSigactionEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RtSigpendingEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RtSigprocmaskEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RtSigqueueinfoEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RtSigreturnEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RtSigsuspendEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RtSigtimedwaitEventID — darwin/amd64, linux/amd64, windows/amd64

+ const RtSigtimedwaitTime32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const RtTgsigqueueinfoEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SchedGetPriorityMaxEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SchedGetPriorityMinEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SchedGetaffinityEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SchedGetattrEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SchedGetparamEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SchedGetschedulerEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SchedProcessExecEventID

+ const SchedProcessExitEventID

+ const SchedProcessForkEventID

+ const SchedRrGetInterval32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const SchedRrGetIntervalEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SchedSetaffinityEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SchedSetattrEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SchedSetparamEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SchedSetschedulerEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SchedSwitchEventID

+ const SchedYieldEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SeccompEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SecurityBPFEventID

+ const SecurityBPFMapEventID

+ const SecurityBprmCheckEventID

+ const SecurityEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SecurityFileOpenEventID

+ const SecurityInodeMknodEventID

+ const SecurityInodeSymlinkEventId

+ const SecurityInodeUnlinkEventID

+ const SecurityKernelReadFileEventID

+ const SecurityPostReadFileEventID

+ const SecuritySbMountEventID

+ const SecuritySocketAcceptEventID

+ const SecuritySocketBindEventID

+ const SecuritySocketConnectEventID

+ const SecuritySocketCreateEventID

+ const SecuritySocketListenEventID

+ const SelectEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SemctlEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SemgetEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SemopEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SemtimedopEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Sendfile32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const SendfileEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SendmmsgEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SendmsgEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SendtoEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetMempolicyEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetRobustListEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetThreadAreaEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetTidAddressEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetdomainnameEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Setfsgid16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetfsgidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Setfsuid16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetfsuidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Setgid16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetgidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Setgroups16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetgroupsEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SethostnameEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetitimerEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetnsEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetpgidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetpriorityEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Setregid16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetregidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Setresgid16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetresgidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Setresuid16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetresuidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Setreuid16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetreuidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetrlimitEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetsidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetsockoptEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SettimeofdayEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Setuid16EventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetuidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SetxattrEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SgetmaskEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ShmatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ShmctlEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ShmdtEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ShmgetEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ShutdownEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SigactionEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SigaltstackEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SignalEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Signalfd4EventID — darwin/amd64, linux/amd64, windows/amd64

+ const SignalfdEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SigpendingEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SigprocmaskEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SigreturnEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SigsuspendEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SocketDupEventID

+ const SocketEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SocketcallEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SocketpairEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SpliceEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SsetmaskEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Stat64EventID — darwin/amd64, linux/amd64, windows/amd64

+ const StatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Statfs64EventID — darwin/amd64, linux/amd64, windows/amd64

+ const StatfsEventID — darwin/amd64, linux/amd64, windows/amd64

+ const StatxEventID — darwin/amd64, linux/amd64, windows/amd64

+ const StimeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SttyEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SwapoffEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SwaponEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SwitchTaskNSEventID

+ const SymlinkEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SymlinkatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SyncEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SyncFileRangeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SyncfsEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SysEnterEventID

+ const SysExitEventID

+ const SysctlEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SysfsEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SysinfoEventID — darwin/amd64, linux/amd64, windows/amd64

+ const SyslogEventID — darwin/amd64, linux/amd64, windows/amd64

+ const TeeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const TgkillEventID — darwin/amd64, linux/amd64, windows/amd64

+ const TimeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const TimerCreateEventID — darwin/amd64, linux/amd64, windows/amd64

+ const TimerDeleteEventID — darwin/amd64, linux/amd64, windows/amd64

+ const TimerGetoverrunEventID — darwin/amd64, linux/amd64, windows/amd64

+ const TimerGettime32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const TimerGettimeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const TimerSettime32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const TimerSettimeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const TimerfdCreateEventID — darwin/amd64, linux/amd64, windows/amd64

+ const TimerfdGettime32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const TimerfdGettimeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const TimerfdSettime32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const TimerfdSettimeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const TimesEventID — darwin/amd64, linux/amd64, windows/amd64

+ const TkillEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Truncate64EventID — darwin/amd64, linux/amd64, windows/amd64

+ const TruncateEventID — darwin/amd64, linux/amd64, windows/amd64

+ const TuxcallEventID — darwin/amd64, linux/amd64, windows/amd64

+ const UlimitEventID — darwin/amd64, linux/amd64, windows/amd64

+ const UmaskEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Umount2EventID — darwin/amd64, linux/amd64, windows/amd64

+ const UmountEventID — darwin/amd64, linux/amd64, windows/amd64

+ const UnameEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Unique32BitSyscallsEndID — darwin/amd64, linux/amd64, windows/amd64

+ const Unique32BitSyscallsStartID

+ const UnlinkEventID — darwin/amd64, linux/amd64, windows/amd64

+ const UnlinkatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const UnshareEventID — darwin/amd64, linux/amd64, windows/amd64

+ const UselibEventID — darwin/amd64, linux/amd64, windows/amd64

+ const UserfaultfdEventID — darwin/amd64, linux/amd64, windows/amd64

+ const UstatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const UtimeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const UtimensatEventID — darwin/amd64, linux/amd64, windows/amd64

+ const UtimensatTime32EventID — darwin/amd64, linux/amd64, windows/amd64

+ const UtimesEventID — darwin/amd64, linux/amd64, windows/amd64

+ const VforkEventID — darwin/amd64, linux/amd64, windows/amd64

+ const VfsWriteEventID

+ const VfsWritevEventID

+ const VhangupEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Vm86EventID — darwin/amd64, linux/amd64, windows/amd64

+ const Vm86oldEventID — darwin/amd64, linux/amd64, windows/amd64

+ const VmspliceEventID — darwin/amd64, linux/amd64, windows/amd64

+ const VserverEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Wait4EventID — darwin/amd64, linux/amd64, windows/amd64

+ const WaitidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const WaitpidEventID — darwin/amd64, linux/amd64, windows/amd64

+ const WriteEventID — darwin/amd64, linux/amd64, windows/amd64

+ const WritevEventID — darwin/amd64, linux/amd64, windows/amd64

+ var EventsDefinitions = map[int32]EventDefinition

+ func CopyFileByPath(src, dst string) error

+ func CreateInitNamespacesEvent() (trace.Event, error)

+ func CreateNetEvent(eventMeta bufferdecoder.NetEventMetadata, ctx procinfo.ProcessCtx, ...) trace.Event

+ func MergeErrors(cs ...<-chan error) <-chan error

+ func ParseKernelReadFileId(id int32) (string, error)

+ type ArgFilter struct

+ Enabled bool

+ Filters map[int32]map[string]ArgFilterVal

+ func (filter *ArgFilter) Parse(filterName string, operatorAndValues string, eventsNameToID map[string]int32) error

+ type ArgFilterVal struct

+ Equal []string

+ NotEqual []string

+ type BoolFilter struct

+ Enabled bool

+ Value bool

+ func (filter *BoolFilter) FilterOut() bool

+ func (filter *BoolFilter) Parse(value string) error

+ type CaptureConfig struct

+ Exec bool

+ FileWrite bool

+ FilterFileWrite []string

+ Mem bool

+ Module bool

+ NetIfaces []string

+ NetPerContainer bool

+ NetPerProcess bool

+ OutputPath string

+ Profile bool

+ type Config struct

+ BPFObjBytes []byte

+ BPFObjPath string

+ BTFObjPath string

+ BlobPerfBufferSize int

+ Cache queue.CacheConfig

+ Capture *CaptureConfig

+ ChanErrors chan error

+ ChanEvents chan trace.Event

+ Debug bool

+ Filter *Filter

+ KernelConfig *helpers.KernelConfig

+ Output *OutputConfig

+ PerfBufferSize int

+ ProcessInfo bool

+ func (tc Config) Validate() error

+ type ContIDFilter struct

+ Enabled bool

+ Equal []string

+ NotEqual []string

+ func (filter *ContIDFilter) FilterOut() bool

+ func (filter *ContIDFilter) Parse(operatorAndValues string) error

+ func (filter *ContIDFilter) Set(bpfModule *bpf.Module, conts *containers.Containers, filterMapName string) error

+ type EventDefinition struct

+ Dependencies []dependency

+ EssentialEvent bool

+ ID32Bit int32

+ Name string

+ Params []trace.ArgMeta

+ Probes []probe

+ Sets []string

+ type Filter struct

+ ArgFilter *ArgFilter

+ CommFilter *StringFilter

+ ContFilter *BoolFilter

+ ContIDFilter *ContIDFilter

+ EventsToTrace []int32

+ Follow bool

+ MntNSFilter *UintFilter

+ NewContFilter *BoolFilter

+ NewPidFilter *BoolFilter

+ PIDFilter *UintFilter

+ PidNSFilter *UintFilter

+ ProcessTreeFilter *ProcessTreeFilter

+ RetFilter *RetFilter

+ UIDFilter *UintFilter

+ UTSFilter *StringFilter

+ type IntFilter struct

+ Enabled bool

+ Equal []int64

+ Greater int64

+ Is32Bit bool

+ Less int64

+ NotEqual []int64

+ func (filter *IntFilter) Parse(operatorAndValues string) error

+ type OutputConfig struct

+ DetectSyscall bool

+ EventsSorting bool

+ ExecEnv bool

+ ExecHash bool

+ ParseArguments bool

+ RelativeTime bool

+ StackAddresses bool

+ type ProcessTreeFilter struct

+ Enabled bool

+ PIDs map[uint32]bool

+ func (filter *ProcessTreeFilter) FilterOut() bool

+ func (filter *ProcessTreeFilter) Parse(operatorAndValues string) error

+ func (filter *ProcessTreeFilter) Set(bpfModule *bpf.Module) error

+ type RetFilter struct

+ Enabled bool

+ Filters map[int32]IntFilter

+ func (filter *RetFilter) Parse(filterName string, operatorAndValues string, eventsNameToID map[string]int32) error

+ type StringFilter struct

+ Enabled bool

+ Equal []string

+ NotEqual []string

+ Size uint

+ func (filter *StringFilter) FilterOut() bool

+ func (filter *StringFilter) Parse(operatorAndValues string) error

+ func (filter *StringFilter) Set(bpfModule *bpf.Module, filterMapName string) error

+ type Tracee struct

+ StackAddressesMap *bpf.BPFMap

+ func New(cfg Config) (*Tracee, error)

+ func (t *Tracee) Close()

+ func (t *Tracee) CreateExistingContainersEvents() []trace.Event

+ func (t *Tracee) Run(ctx gocontext.Context) error

+ func (t *Tracee) Stats() *metrics.Stats

+ func (t *Tracee) WaitForPipeline(errs ...<-chan error) error

+ type UintFilter struct

+ Enabled bool

+ Equal []uint64

+ Greater uint64

+ Is32Bit bool

+ Less uint64

+ NotEqual []uint64

+ func (filter *UintFilter) FilterOut() bool

+ func (filter *UintFilter) Parse(operatorAndValues string) error

+ func (filter *UintFilter) Set(bpfModule *bpf.Module, filterMapName string, lessIdx uint32) error

v0.7.0-rc1

Mar 16, 2022

v0.7.0-rc-2

Mar 28, 2022

v0.7.0-rc-1

Mar 21, 2022

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL