{"id":26293486,"url":"https://github.com/sandro108/ebpf_programs","last_synced_at":"2026-04-25T18:31:18.723Z","repository":{"id":279461131,"uuid":"911142701","full_name":"sandro108/ebpf_programs","owner":"sandro108","description":"This repo contains a small but hopefully growing collection of custom eBPF programs","archived":false,"fork":false,"pushed_at":"2025-03-14T12:10:42.000Z","size":5074,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2026-01-01T21:50:32.434Z","etag":null,"topics":["ebpf","nfs4"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sandro108.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-01-02T10:40:52.000Z","updated_at":"2025-03-14T13:21:41.000Z","dependencies_parsed_at":null,"dependency_job_id":"2b238c4b-7365-4b68-8722-562d6fea0f53","html_url":"https://github.com/sandro108/ebpf_programs","commit_stats":null,"previous_names":["sandro108/ebpf_programs"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/sandro108/ebpf_programs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sandro108%2Febpf_programs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sandro108%2Febpf_programs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sandro108%2Febpf_programs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sandro108%2Febpf_programs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sandro108","download_url":"https://codeload.github.com/sandro108/ebpf_programs/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sandro108%2Febpf_programs/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32273192,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-25T18:29:39.964Z","status":"ssl_error","status_checked_at":"2026-04-25T18:29:32.149Z","response_time":59,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ebpf","nfs4"],"created_at":"2025-03-15T02:18:45.245Z","updated_at":"2026-04-25T18:31:18.702Z","avatar_url":"https://github.com/sandro108.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"## Welcome!\n**This repository contains custom made bpf programs, that were developed according to specific needs of system administrators. \u003cbr\u003e\nSo far, two of the programs collect NFSv4+ (Network Filesystem version 4+) related kernel metrics. \u003cbr\u003e\nAnother one gathers metrics associated with sockets and yet another has a rather peculiar purpose. \u003cbr\u003e\nSee descriptions below for details.**\u003cbr\u003e\n\nThese bpf programs can be used, shared, extended or otherwise modified according to your specific needs.\u003cbr\u003e\nThe bpf programs were tested with Linux kernel version 5.14.0-503.26.1.el9_5.x86_64. \u003cbr\u003e\nHelp with improving and extending this collection is very much appreciated. \u003cbr\u003e\n\n\n\n\n\n## Here is what the bpf programs do:\n1. [nfs4_byte_picker](#1-nfs4_byte_picker)\n2. [nfs4_path_finder](#2-nfs4_path_finder)\n3. [socket_collector](#3-socket_collector)\n4. [open_stat_interceptor](#4-open_stat_interceptor)\n\n\n## 1. nfs4_byte_picker\n\nThe ```nfs4_byte_picker``` program collects the bytes sent and received via NFSv4 in each RPC round-trip. As the sample output below shows, the \"rpc_task_owner_pid\" and corresponding \"rpc_task_owner_uid\" fields contain the PID and UID of the userland process, if applicable, that triggered the NFSv4 request across the Linux NFS client.  \n\n![Oops, something went wrong while loading the image!](resources/nfs4_byte_picker_json.png \"sample JSON output of the 'nfs4_byte_picker' ebpf program\")\n\n\n## 2. nfs4_path_finder\n\nThe ```nfs4_path_finder``` program assembles NFSv4 paths opened by userland processes, whenever these are scheduled and executed on a CPU.\n\n![Oops, something went wrong while loading the image!](resources/nfs4_path_finderV.png \"sample JSON output of the 'nfs4_path_finder' ebpf program\")\n\n\n## 3. socket_collector\n\nThe ```socket_collector``` program collects kernel metrics of sockets opened by userland processes.\n![Oops, something went wrong while loading the image](resources/socket_collector_json.png \"sample JSON output of the 'socket_collector' ebpf program\")\n\n\n## 4. open_stat_interceptor\n\nThe ```open_stat_interceptor``` outputs an alert, whenever a userland process calls a ```stat()``` on the parent directory of a file previously opened by the same process with an ```O_CREAT``` flag set.\n\n![Oops, something went wrong while loading the image](resources/open_stat_interceptor.png \"sample JSON output of the 'open_stat_interceptor' ebpf program\")\n\n\nFor more information on the usage and options, see the help output of each program.\n\nMay this be helpful :) ","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsandro108%2Febpf_programs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsandro108%2Febpf_programs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsandro108%2Febpf_programs/lists"}