- Kubernetes & CNCF -
Ever wished you could monitor your AWS load balancer logs in real-time? AWS ELB access logs are packed with security gold, but they’re usually just sitting in S3 as static files. Let’s fix that with a falco-plugin-aws-elb! What is Falco 🦅? Falco is your friendly neighborhood security watchdog. It’s an open-source tool that keeps an… Continue reading Built a Falco Plugin for AWS ELB Access Logs →
On June 16, 2025, I gave a Lightning Talk at KubeCon + CloudNativeCon Japan 2025. The title of my talk was: “From Kernel To Kubernetes: Mapping eBPF-Detected Processes To Pods!” In this session, I explored how Tetragon connects the Linux kernel to Kubernetes by enriching eBPF-detected process data with Kubernetes metadata. You can check out… Continue reading From Kernel to Kubernetes: KubeCon +…
On Mar 15, 2025, I had the pleasure of presenting at the Cloud Native Community Japan – eBPF Japan Meetup #3, where I introduced Tetragon’s implementation of eBPF-based Process Lifecycle Monitoring. I’d like to share a brief overview of my talk in this blog post. You can access all my materials here: About Tetragon Tetragon… Continue reading Inside Tetragon: How eBPF Powers Process Lifecycle…
When working with eBPF, retrieving process and thread information is essential for monitoring and observability. One commonly used helper function for this purpose is bpf_get_current_pid_tgid(). It provides both Thread Group ID (TGID) and the Process ID (PID). But what exactly are TDID and PID, and how do they differ🤔? Extracting TGID and PID with eBPF Let’s… Continue reading Getting to Know TGID…
TL;DR; I created eBPF-based software in Rust that can monitor the Process lifecycle.🦀🐝 Motivation Tetragon-mini is a project where I’m trying to see if I can rewrite Tetragon using the Rust aya framework🦀. The original Tetragon is written in Go and C. I was really impressed by Tetragon, and while digging into how it works,… Continue reading Tetragon-mini by Rust: eBPF-based process monitoring →
TL;DR This guide demonstrates how to implement eBPF Tail Calls using Rust’s Aya. 🦀🐝 Introduction: Tail Calls Tail calls in eBPF allow splitting complex logic into multiple programs, functioning like a ‘goto’ statement. Benefits of using tail calls include distributing complexity across smaller parts and updating or replacing logic without downtime. However, there are some… Continue reading eBPF…
TL;DR In this post, I’ll walk you through an example of an eBPF Kprobe program using Aya with Rust. 🦀🐝 Introduction: Kprobes Kprobe (Kernel Probe) is a debugging and tracing mechanism for the Linux kernel. BPF programs can now be used with Kprobes. When writing a BPF program for a Kprobe, you can choose to… Continue reading Writing eBPF Kprobe Program with Rust Aya →
TL;DR In this post, I’ll walk you through an example of an eBPF RawTracepoint program using Aya with Rust. 🦀🐝 Introduction: RawTracepoints vs Tracepoints RawTracepoints and Tracepoints in the Linux kernel are static markers placed at key locations within the kernel code. These markers help debugging, performance monitoring, and deeper insights into kernel behavior. Developers… Continue reading…
TL;DR This post shows an example eBPF Tracepoint program and shares tips on writing the eBPF Tracepoint programs with aya. 🦀🐝 Introduction Dataflow We will run the eBPF program where tracingpoint’s data flows from kernel space to user space like below. Kernel space The eBPF Program trace_sched_process_exec is invoked by tracepoint sched_process_exec. Then, trace_sched_process_exec parses……
TL;DR In this post, I explain how the Tetragon Agent reads process lifecycle data from the eBPF Map and sends it to clients.🐝 Introduction In my previous post, I explained the eBPF part of Tetragon’s process lifecycle observation at the code level. In this post, I will discuss the Tetragon Agent, which is written in… Continue reading Tetragon Process Lifecycle Observation: Tetragon Agent Part →