Monitoring syscalls with ebpf

Summary Link to heading I needed a method to monitor various system calls, and their associated arguments with a specific format. To do so I used ebpf. This is not a complete tutorial by any means on using ebpf, and rather just a simple example of how a system call can be monitored. As a base I forked libbpf-bootstrap , and modified the ksyscall program accordingly. Existing code Link to heading…