Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.
Repository Index
47,133 repositories indexed
1–11 of 11 · Most stars
High-level tracing language for Linux
Linux Runtime Security and Forensics using eBPF
A Windows your apps recognize.
- cmake
- compatibility-layer
- cpp
- cpp20
OCI hook to trace syscalls and generate a seccomp profile
- syscalls
- bcc
- seccomp-profile
- containers
DWARF-aware eBPF tracer for source-level userspace tracing - Explore in a TUI or automate with a scriptable CLI
Low-overhead sampling profiler and tracer for Ruby for Linux
- ruby
- bpf
- performance
- profilers
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
An example of an eBPF program hooking into the kill tracepoint
One Go interface, five backends — filelock, flock, Redis, Postgres, etcd. Distributed locks with fencing tokens, semaphore mode, observability hooks, and TraceID propagation. Swap backends with one line.
- advisory-lock
- concurrency
- distributed-lock
- etcd
A modular Linux telemetry engine built with eBPF, libbpf CO-RE, and Modern C++ that captures kernel-level process, file, syscall, and network events through a portable event-processing pipeline for decoding, enrichment, filtering, and structured output—forming the foundation for higher-level runtime intelligence.
- cpp20
- ebpf
- event-logger
- filesystem