add event handling to tracee-ebpf #1209
AsafEitani
started this conversation in
Development
Replies: 1 comment
-
We have a function named events_perf_submit() used for event submission.
Let's convert this issue to a discussion before we decide if we want to open an issue for this |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
We should add a function to tracee-ebpf in tracee.bpf.c that will handle the event submission for all events.
That way we will have one central place where configurations could be checked, artifact can be captured and enrichments can be made such as adding the syscall that called the function (detect-syscall flag).
This will make the code more organized, provide easier debugging of issues and reduce the overall duplicate code.
Beta Was this translation helpful? Give feedback.
All reactions