watcher icon indicating copy to clipboard operation
watcher copied to clipboard

Published 20 hours ago • verified publisher icon e-dant

Watch proc with ebpf

Open e-dant opened this issue 1 year ago • 1 comments

One of the only filesystems we can't watch is the virtual /proc filesystem on Linux.

There is a way to create an ebpf program for the kernel to run which lets us know about modification events on those paths.

e-dant avatar Nov 25 '23 15:11 e-dant

https://github.com/e-dant/watcher-bpf-experimental

e-dant avatar May 25 '24 16:05 e-dant