{"id":50774795,"url":"https://github.com/nudgebee/node-agent","last_synced_at":"2026-06-11T22:30:33.049Z","repository":{"id":361988597,"uuid":"743506217","full_name":"nudgebee/node-agent","owner":"nudgebee","description":"Per-node observability agent for Kubernetes and Linux hosts. Gathers container and host metrics, logs, and L7 traffic via eBPF; exports to Prometheus and OpenTelemetry. Includes LLM API observability.","archived":false,"fork":false,"pushed_at":"2026-06-02T04:30:13.000Z","size":135521,"stargazers_count":0,"open_issues_count":3,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2026-06-02T06:21:46.716Z","etag":null,"topics":["ebpf","golang","kubernetes","llm-observability","monitoring","node-agent","observability","opentelemetry","prometheus","sre"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nudgebee.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-01-15T11:38:23.000Z","updated_at":"2026-06-02T04:27:27.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/nudgebee/node-agent","commit_stats":null,"previous_names":["nudgebee/node-agent"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/nudgebee/node-agent","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nudgebee%2Fnode-agent","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nudgebee%2Fnode-agent/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nudgebee%2Fnode-agent/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nudgebee%2Fnode-agent/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nudgebee","download_url":"https://codeload.github.com/nudgebee/node-agent/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nudgebee%2Fnode-agent/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34221150,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-11T02:00:06.485Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ebpf","golang","kubernetes","llm-observability","monitoring","node-agent","observability","opentelemetry","prometheus","sre"],"created_at":"2026-06-11T22:30:32.343Z","updated_at":"2026-06-11T22:30:33.043Z","avatar_url":"https://github.com/nudgebee.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Nudgebee Node Agent\n\n[![Continuous Integration](https://github.com/nudgebee/node-agent/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/nudgebee/node-agent/actions/workflows/ci.yml)\n[![Go Report Card](https://goreportcard.com/badge/github.com/nudgebee/node-agent)](https://goreportcard.com/report/github.com/nudgebee/node-agent)\n[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)\n\nA per-node observability agent for Kubernetes and Linux hosts. The agent\ngathers container and host metrics, logs, and L7 traffic using eBPF and\nexposes them in Prometheus format.\n\nMinimum Linux kernel: **5.1** (eBPF CO-RE).\n\n\u003e This project is a fork of\n\u003e [coroot/coroot-node-agent](https://github.com/coroot/coroot-node-agent)\n\u003e with additional features developed at Nudgebee. See [NOTICE](NOTICE)\n\u003e for attribution and [CHANGELOG.md](CHANGELOG.md) for the list of\n\u003e divergences from upstream.\n\n## Features\n\n### Inherited from upstream\n\n- **TCP connection tracing** — service map and inter-service latency,\n  derived from eBPF `connect()` / `accept()` / retransmit / RTT events.\n- **Log pattern extraction** — clusters container logs into recurring\n  patterns at the node, drastically reducing log volume for analysis.\n  Reads from `/var/log/`, journald, dockerd, and containerd CRI logs.\n- **Delay accounting** — per-container CPU and disk-wait metrics from\n  the kernel's [delay accounting](https://www.kernel.org/doc/html/latest/accounting/delay-accounting.html)\n  subsystem via Netlink.\n- **OOM-kill events** — surfaces `container_oom_kills_total`.\n- **Cloud instance metadata** — auto-detects AWS, GCP, Azure, Hetzner,\n  IBM Cloud, and Oracle Cloud and tags metrics with account ID,\n  instance type, region, AZ, lifecycle (spot/on-demand), and addresses.\n- **GPU monitoring** (NVIDIA via NVML), JVM metrics (via JMX/jattach),\n  .NET and Node.js process detection.\n\n### Added in this fork\n\n- **[LLM observability](docs/llm-observability.md)** — detects calls\n  to OpenAI, Anthropic, AWS Bedrock, Google AI / Vertex, Azure OpenAI,\n  Cohere, and OpenAI-compatible endpoints from eBPF-traced TLS\n  sessions, and emits per-request metrics including model name, token\n  counts, latency, time-to-first-token, and estimated cost.\n- **[IP-to-FQDN resolver](docs/ip-fqdn-resolver.md)** — enriches\n  outbound flows with hostnames and K8s workload identity by\n  combining Service/Pod/Node informers with the DNS cache, so the\n  service map shows `payments-api` instead of `10.0.5.41`.\n- **Enhanced L7 protocol detection** — TLS SNI extraction, lightweight\n  HTTP/2 parsing with HPACK, improved Go TLS capture, Node.js TLS,\n  FoundationDB.\n- **PSI cgroup metrics** — pressure-stall info for CPU, memory, and IO.\n- **Stability fixes** — graceful shutdown, bounded caches, label\n  cardinality controls, panic guards in L7 parsers, OOM mitigations.\n\n## Installation\n\n### Kubernetes (DaemonSet)\n\n```sh\nkubectl apply -f https://raw.githubusercontent.com/nudgebee/node-agent/main/manifests/nudgebee-node-agent.yaml\n```\n\nThis creates the `nudgebee` namespace and a privileged DaemonSet that\nexposes `/metrics` on port 80.\n\n### systemd (bare-metal)\n\n```sh\ncurl -fsSL https://raw.githubusercontent.com/nudgebee/node-agent/main/install.sh | sudo sh -\n```\n\nPass `-v vX.Y.Z` to pin to a specific release. The script writes a\nsystemd unit at `/etc/systemd/system/nudgebee-node-agent.service` and\nstarts it.\n\n### Container image\n\nMulti-arch images (linux/amd64, linux/arm64) are published to GHCR on\nevery tag:\n\n```\nghcr.io/nudgebee/node-agent:\u003cversion\u003e\nghcr.io/nudgebee/node-agent:\u003cmajor\u003e.\u003cminor\u003e\nghcr.io/nudgebee/node-agent:\u003cmajor\u003e\n```\n\n## Metrics\n\nThe agent exposes Prometheus metrics on `:80/metrics`. Self-identifying\nlabel: `job=\"nudgebee-node-agent\"`.\n\n- Nudgebee-specific metrics:\n  - [LLM observability](docs/llm-observability.md#metrics-emitted)\n  - [IP-to-FQDN resolver](docs/ip-fqdn-resolver.md)\n- The full inherited metric catalogue is documented upstream at\n  [docs.coroot.com/metrics/node-agent](https://docs.coroot.com/metrics/node-agent).\n\n## Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md). Bug reports and pull requests\nare welcome.\n\n## Security\n\nPlease report vulnerabilities privately per [SECURITY.md](SECURITY.md).\n\n## License\n\nThis project is licensed under the [Apache License, Version 2.0](LICENSE).\n\nThe eBPF C code in `ebpftracer/ebpf/` is licensed under the GNU General\nPublic License, Version 2.0; see [LICENSES/GPL-2.0.txt](LICENSES/GPL-2.0.txt).\n\nSee [NOTICE](NOTICE) for attribution to the original\ncoroot/coroot-node-agent project.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnudgebee%2Fnode-agent","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnudgebee%2Fnode-agent","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnudgebee%2Fnode-agent/lists"}