initialize

Documentation

Index

• func BpfObject(cfg *config.Config, kConfig *environment.KernelConfig, ...) error
• func CreateEventsFromSignatures(startId events.ID, sigs []detect.Signature) map[string]int32
• func KernelConfig() (*environment.KernelConfig, error)
• func SetLibbpfgoCallbacks()

Functions

func BpfObject

func BpfObject(cfg *config.Config, kConfig *environment.KernelConfig, osInfo *environment.OSInfo, installPath string, version string) error

BpfObject sets up and configures a BPF object for tracing and monitoring system events within the kernel. It takes pointers to tracker.Config, environment.KernelConfig, and environment.OSInfo structures, as well as an installation path and a version string. The function unpacks the CO-RE eBPF object binary, checks if BTF is enabled, unpacks the BTF file from BTF Hub if necessary, and assigns the kernel configuration and BPF object bytes.

func CreateEventsFromSignatures

func CreateEventsFromSignatures(startId events.ID, sigs []detect.Signature) map[string]int32

func KernelConfig

func KernelConfig() (*environment.KernelConfig, error)

func SetLibbpfgoCallbacks

func SetLibbpfgoCallbacks()

SetLibbpfgoCallbacks sets libbpfgo logger callbacks