Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 26 additions & 3 deletions pipeline/inputs/ebpf.md
Original file line number Diff line number Diff line change
Expand Up @@ -57,26 +57,49 @@ To enable the `in_ebpf` plugin, follow these steps to build Fluent Bit from sour
Run Fluent Bit with elevated permissions (for example, `sudo`). Loading eBPF programs requires root access or appropriate privileges.

```bash
sudo ./bin/fluent-bit -c path/to/your_config.conf
# For YAML configuration.
$ sudo ./bin/fluent-bit --config fluent-bit.yaml

# For classic configuration.
$ sudo ./bin/fluent-bit --config fluent-bit.conf
```

## Configuration example

Here's a basic example of how to configure the plugin:

```python
{% tabs %}
{% tab title="fluent-bit.yaml" %}

```yaml
pipeline:
inputs:
- name: ebpf
trace:
- trace_signal
- trace_malloc
- trace_bind
```

{% endtab %}
{% tab title="fluent-bit.conf" %}

```text
[INPUT]
Name ebpf
Trace trace_signal
Trace trace_malloc
Trace trace_bind
```

{% endtab %}
{% endtabs %}

The configuration enables tracing for:

- Signal handling events (`trace_signal`)
- Memory allocation events (`trace_malloc`)
- Network bind operations (`trace_bind`)

You can enable multiple traces by adding multiple `Trace` directives in your configuration.
Full list of existing traces can be seen here: [Fluent Bit eBPF Traces](https://github.com/fluent/fluent-bit/tree/master/plugins/in_ebpf/traces)
Full list of existing traces can be seen here: [Fluent Bit eBPF Traces](https://github.com/fluent/fluent-bit/tree/master/plugins/in_ebpf/traces)