tracee
tracee copied to clipboard
[FEAT] Wait for perf buffer to empty before exiting tracee-ebpf
Prerequisites
- [x] This issue is an EPIC issue (add label: EPIC).
- [ ] This issue is an EPIC TASK (add issue to EPIC description).
Select one OR another:
- [ ] I'll create a PR to implement this feature (assign to yourself).
- [x] Someone else should implement this (describe it well).
Feature description
After sending a termination signal to tracee-ebpf (Ctrl+C), tracee-ebpf should first kill the bpf programs, and continue to consume events from the perf buffer in the go userspace. This will empty the perf buffer and no event will be lost due to premature exit.