https://github.com/rinhizakura/ebpf-strace

A demonstration to show how to trace syscalls by eBPF
https://github.com/rinhizakura/ebpf-strace

ebpf linux strace syscalls

Last synced: about 2 months ago
JSON representation

A demonstration to show how to trace syscalls by eBPF

• Host: GitHub
• URL: https://github.com/rinhizakura/ebpf-strace
• Owner: RinHizakura
• Created: 2023-03-27T10:02:15.000Z (over 1 year ago)
• Default Branch: main
• Last Pushed: 2024-10-16T17:07:19.000Z (2 months ago)
• Last Synced: 2024-10-19T09:51:41.478Z (2 months ago)
• Topics: ebpf, linux, strace, syscalls
• Language: C
• Homepage:
• Size: 822 KB
• Stars: 4
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# ebpf-strace

A tiny tool to trace syscalls by eBPF

> WARNING: Currently, the tool can only be run on x86_64. Besides,

> only a few syscalls's arguments can be traced.

## Usage

These dependencies are required to build ebpf-strace.

```

$ sudo apt install clang llvm libelf1 libelf-dev zlib1g-dev

```

You will also need `bpftool` for the generating of `vmlinux.h`.

```

$ git clone https://github.com/libbpf/bpftool.git

$ cd bpftool

$ git submodule update --init

$ cd src

$ make

$ sudo make install

```

After the installations, you can build `ebpf-strace` now.

```

$ make

```

For example, we can trace which system calls are run during the execution

of `echo hello` with the following command:

```

$ sudo ./ebpf-strace echo hello

```