Tags: elastic/quark
Tags
Release 0.4 Notable changes: * Add support for linking with system libraries. * quark_queue_get_events removed in favor of quark_queue_get_event. * TCP socket lifecycle events, experimental. * No more snapshots as events, see CHANGES. * DNS request/reply events, experimental. * Support fentry probes in addition to kprobes. * QQ_BYPASS allows fetching events from the EBPF ring buffer, no processing involved. * Support for musl, because they're awesome. * Add file probes, only available in QQ_BYPASS for now. * Removed path limitation, it now respects MAXPATHLEN. * Add the -1 option to quark-test so it doesn't for for tests. * Add cgroups to process events.
Release 0.3
Notable changes:
* A new binary, quark-test(8) for testing the suite.
* An initramfs.gz target including init and infrastructure to run quark-test
statically built on any kernel via qemu.
* Quark now knows about 4 namespaces (uts,ipc,mnt,net) and they're included in
quark_process{}.
* Fixed pgid in RHEL8 since the enum value changes, also fixed upstream
elastic/ebpf.
Release 0.1 First release of quark, to be matched with go-quark. A quick note on what this very first release includes: * Kprobe & EBPF backends * Process aggregation * Event flow control * Proper documentation * 3940 compiled btfhub offsets * quark-mon(8) and quark-btf(8) * Go bindings Many thanks to everyone involved, especially: @nicholasberlin, @mjwolf and @fearful-symmetry. And there was much rejoicing.