6 commits

Author	SHA1	Message	Date
Gustavo Iñiguez Goia	68c2c8ae1a	ebpf: fixed getting ppid, skip failed execve's ... - Fixed getting ppid (precompiled .o won't probably work). - Skip failed execve* calls.	2023-12-26 14:04:19 +01:00
Gustavo Iñiguez Goia	210e843aab	moved basic ebpf definitions to its own file ... BPF_MAP_TYPE_PERCPU_ARRAY was introduced in kernel version 4.6, so with latest changes to intercept processes we lost support for older kernels < 4.6. Now we work again for example on kernels 4.4.	2022-12-21 21:11:40 +01:00
Gustavo Iñiguez Goia	7cbfca6b1f	ebpf: increased ring buffer size, hook execveat ... Increased perf map buffer size to avoid lose events under heavy loads. Hook execveat to intercept executions from memory.	2022-10-13 01:44:23 +02:00
Gustavo Iñiguez Goia	fc3d7382de	ebpf: get cmdline arguments from kernel ... - Get cmdline arguments from kernel along with the absolute path to the binary. If the cmdline has more than 20 arguments, or one of the arguments is longer than 256 bytes, get it from ProcFS. - Improved stopping ebpf monitor method.	2022-07-12 15:40:01 +02:00
Gustavo Iñiguez Goia	72483bdcde	improved process detection ... latest changes to detect short-lived processes caused undesired behaviour (#694) Closes #685	2022-07-08 17:15:57 +02:00
Gustavo Iñiguez Goia	e7024e3fe0	ebpf: support for long paths ... Added support to report absolute path to a binary up to 4096 characters, defined here: https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/limits.h#L13	2022-06-27 14:42:54 +02:00