You can configure your endpoints to collect telemetry using eBPF instead of AuditD.
Estimated procedure time: 10 minutes
Before making any changes to your sensors, check the Linux EDR system requirements to determine whether eBPF data collection is supported for your endpoints.
To enable eBPF, you'll need to make the following changes to each sensor:
- Update the sensor configuration file.
- Optionally disable the DebugFS automount feature.
- Restart the sensor.
Update the sensor configuration file
- Go to
config.json, and add the following lines:
- Save the file.
Note: If the eBPF initialization fails, the sensor defaults to using AuditD. If you’d prefer the sensor to turn off by default, add
"restricted": "true" to the
Optional: Disable DebugFS automount
In order to collect telemetry using eBPF, your endpoint must be able to access the debug file system, also known as DebugFS. DebugFS is mounted by default on most Linux systems. If DebugFS isn’t already mounted, the sensor will try to mount it for you. You can disable the automount feature by adding
"automount": "false" to the
Restart the sensor
Your configuration changes won't take effect until you restart the sensor. For instructions on restarting the Linux EDR sensor service, see Agent Debugging.