{"id":19270397,"url":"https://github.com/netdata/kernel-collector","last_synced_at":"2026-04-01T20:23:00.005Z","repository":{"id":39613408,"uuid":"238094312","full_name":"netdata/kernel-collector","owner":"netdata","description":"Linux Kernel eBPF Collectors","archived":false,"fork":false,"pushed_at":"2025-07-18T14:14:30.000Z","size":10273,"stargazers_count":64,"open_issues_count":13,"forks_count":15,"subscribers_count":16,"default_branch":"master","last_synced_at":"2025-07-18T16:57:15.412Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/netdata.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-02-04T00:58:36.000Z","updated_at":"2025-07-18T14:10:29.000Z","dependencies_parsed_at":"2023-10-01T22:49:18.106Z","dependency_job_id":"e79b1902-c3d9-4a13-9828-81d213ad7508","html_url":"https://github.com/netdata/kernel-collector","commit_stats":null,"previous_names":[],"tags_count":106,"template":false,"template_full_name":null,"purl":"pkg:github/netdata/kernel-collector","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/netdata%2Fkernel-collector","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/netdata%2Fkernel-collector/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/netdata%2Fkernel-collector/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/netdata%2Fkernel-collector/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/netdata","download_url":"https://codeload.github.com/netdata/kernel-collector/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/netdata%2Fkernel-collector/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":267213513,"owners_count":24053912,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-26T02:00:08.937Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-09T20:24:40.435Z","updated_at":"2026-04-01T20:22:54.978Z","avatar_url":"https://github.com/netdata.png","language":"C","readme":"# kernel-collector\n\n![CI](https://github.com/netdata/kernel-collector/workflows/CI/badge.svg)\n![CD](https://github.com/netdata/kernel-collector/workflows/CD/badge.svg)\n\nLinux Kernel eBPF Collectors\n\n## Directory structure\n\nThe respository has the following directory structure:\n\n- `artifacts`: directory that will have the eBPF programs when the compilation\n  process ends.\n- `co-re`: contains all eBPF programs that utilize eBPF CO-RE (Compile Once -\n  Run Everywhere) technology.\n    - `tests`: contains test cases for our eBPF CO-RE programs.\n- `docs`: contains an assortment of documentation related to this repository.\n- `includes`: headers used throughout the project.\n- `kernel`: contains all eBPF programs that don't utilize eBPF CO-RE\n  technology; these may be considered legacy more and more as time progresses\n  and we shift fully to CO-RE.\n- `kernel-patches`: contains patches needed to properly compile our legacy\n  `kernel/` eBPF programs on some kernel versions.\n- `libbpf`: this is a submodule'd fork of\n  [netdata/libbpf](https://github.com/netdata/libbpf) which is itself a fork of\n  the official `libbpf` package, the user-space side of eBPF system calls.\n- `tools`: scripts used to verify system status before installing eBPF code.\n\n## Requirements\n\n#### Packages\n\nTo compile the eBPF programs, it will be necessary to have the following\npackages:\n\n- libelf headers\n- LLVM/Clang; this is because GCC prior to 10.0 cannot compile eBPF code.\n- Kernel headers\n\n#### Initializing Submodules\n\n`libbpf` directory is included as a git submodule and it is necessary to fetch contents with the git command below:\n```bash\ngit submodule update --init --recursive\n```\n#### Generating Headers\n\nKernel headers can be extracted directly from the kernel source doing the\nfollowing steps (assumes your kernel source is accessible at `/usr/src/linux`):\n\n```bash\ncd /usr/src/linux\nmake defconfig\nmake scripts\nmake prepare\nmake headers_install\n```\n\n#### Misc\n\nIn case you are using the kernel `5.4` or newer, please comment out the\nfollowing line inside the file `generated/autoconf.h`:\n\n```c\n#define CONFIG_CC_HAS_ASM_INLINE 1\n```\n\n#### Makefiles\n\nIt's also possible that you'll need to change the `Makefile`s in this\nrepository according your environment. The original files were adjusted to\ncompile on Slackware Linux Current.\n\nInside `kernel/Makefile`, you may need to change the following variables:\n\n- `KERNELSOURCE`: Where is your kernel-source? This variable was set initially\n  to work on Slackware, Fedora and Ubuntu.\n- `LINUXINCLUDE`: Depending on the Linux distribution, it may be necessary to\n  add or remove directories from this variable.\n- `LLVM_INCLUDES`: Depending on the kernel version, it may be necessary to\n  change this path.\n\n## Building with Docker\n\nThere are two build environments that produce different variants of libc and\nthe Linux Kernel.\n\nThe build environments are:\n\n- `musl`  =\u003e `Dockerfile.musl` (_based on Alpine 3.11_)\n- `glibc` =\u003e `Dockerfile.glibc.generic` (_based on Ubuntu 20.04_)\n\n### glibc\n\n```sh\n$ docker build -f Dockerfile.glibc.generic -t kernel-collector:glibc ./\n$ docker run --rm -v $PWD:/kernel-collector kernel-collector:glibc\n```\n\n### musl\n\n```sh\n$ docker build -f Dockerfile.musl -t kernel-collector:musl ./\n$ docker run --rm -v $PWD:/kernel-collector kernel-collector:musl\n```\n\n### Different Kernel\n\nTo build for a different Kernel version rather than the default just pass the\n`--build-arg KERNEL_VERSION=\u003ckernel_version\u003e` argument to the `docker build`.\n\nFor example:\n\n```sh\n$ docker build -f Dockerfile.musl -t kernel-collector:musl_5_4 --build--arg KERNEL_VERSION=5.4.18 ./\n$ docker run --rm -v $PWD:/kernel-collector kernel-collector:musl_5_4\n```\n\n### Building with Debug Symbols\n\nTo build with debug symbols enabled, set the environment variable `DEBUG` to `1`\nwhen running the build image.\n\nFor example:\n\n```sh\n$ docker build -f Dockerfile.musl -t kernel-collector:musl ./\n$ docker run --rm -e DEBUG=1 -v $PWD:/kernel-collector kernel-collector:musl\n```\n\nThis sets `EXTRA_CFLAGS=-g` before building.\n\n## Manual Compilation\n\nAfter you've got your `kernel/Makefille` properly setup, you can run the\nfollowing command to compile all the eBPF programs:\n\n```bash\n# build in parallel jobs equal to `nproc` (number of processors)\n$ make -j`nproc`\n```\n\nWhen compilation finishes, you will have a file inside the `artifacts`\ndirectory with contents like the following:\n\n```\npnetdata_ebpf_process.\u003ckernel version\u003e.o\npnetdata_ebpf_socket.\u003ckernel version\u003e.o\nrnetdata_ebpf_process.\u003ckernel version\u003e.o\nrnetdata_ebpf_socket.\u003ckernel version\u003e.o\n...\n```\n\n`p*.o`: eBPF programs used with entry mode, this is the default mode.\n`r*.o`: eBPF programs used with return mode.\n\nThese files have to be copied to your plugins directory, which is usually at\n`/usr/libexec/netdata/plugins.d/`, for the collector to be able to access them.\nAfter this you can start the new collector `ebpf_program.plugin`.\n\n## Releasing\n\nTo release a new version and create a Github Release:\n\n1. Create a Git tag like so:\n\n   ```sh\n   $ TAG=\"v0.0.1\"; git tag -a -s -m \"Release ${TAG}\" \"${TAG}\" \u0026\u0026 git push origin \"${TAG}\"\n   ```\n\n   Replace `v0.0.1` with the next desired tag. SemVer is not strictly being\n   followed here at this time so the specific tagged versions is not so\n   important.\n\n   This will kick off a Github Action Workflow that will Rebuild the Netdata\n   eBPF Kernel Collector for all Kernel and LIBC variants, create a Github\n   Release and upload all assets to the release to be consumed by anyone or the\n   Netdata Installer.\n\n2. Wait for the CD pipeline to finish in the Github Actions UI.\n3. Review the Release, Updates Release Notes, etc in the Github Releases UI.\n4. Push the \"Publish Release\" button in the Github Releases UI.\n\n## Contribution\n\nNetdata is open-source software and we are always open for contributions that\nyou can give us.\n\nIf you want to contribute an eBPF program, then please be sure that your\nprogram matches the following patterns:\n\n- Your program must run on all kernels since at least kernel `4.11`.\n- Write some code that's responsible to measure the latency of your program.\n- We have the variable NETDATASEL, that selects where the functions will be\n  attached. Be sure that inside your code `0` is associated `kretprobe`, and `2` is assoacited\n  with `kprobe`.\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnetdata%2Fkernel-collector","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnetdata%2Fkernel-collector","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnetdata%2Fkernel-collector/lists"}