Repository navigation
Releases: Neo23x0/process-watcher
Release list
process-watcher v0.2.2
process-watcher v0.2.2
Observes the process trees of programs whose executable name contains a configured substring (eBPF, Linux 5.15 or newer with BTF) and logs process creation, exec and exit as JSONL.
What is in a release. One archive per architecture, linux/amd64 and linux/arm64. Each contains process-watcher (a single static binary; the eBPF programs are embedded, nothing else is needed at run time), process-watcher.yaml (the documented example configuration), LICENSE, below php/ the two configurations of the PHP kit (php-observe.yaml observes every PHP runtime, php-fpm-kill-signatures.yaml holds the PHP-FPM response rules and ships as a dry run), usable right after unpacking (the PHP kit has the guide), and in packaging/ the systemd unit with the script that installs it. Every archive is published under two names with the same files: process-watcher_v0.2.2_linux_<arch>.tar.gz (this version) and process-watcher_linux_<arch>.tar.gz (the same name in every release; https://github.com/Neo23x0/process-watcher/releases/latest/download/process-watcher_linux_<arch>.tar.gz serves the newest stable release). SHA256SUMS lists all of them.
Install
ARCH=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/') # amd64 or arm64
curl -fsSLO https://github.com/Neo23x0/process-watcher/releases/download/v0.2.2/process-watcher_v0.2.2_linux_${ARCH}.tar.gz
curl -fsSLO https://github.com/Neo23x0/process-watcher/releases/download/v0.2.2/SHA256SUMS
sha256sum --check --ignore-missing SHA256SUMS
tar xzf process-watcher_v0.2.2_linux_${ARCH}.tar.gz
cd process-watcher_v0.2.2_linux_${ARCH}
sudo ./process-watcher doctor # kernel, BTF, permissions
sudoedit process-watcher.yaml # set watch.image_contains
sudo ./process-watcher # finds process-watcher.yaml next to the binaryThe binary needs root (or CAP_BPF and CAP_PERFMON) and the host's PID namespace. To keep it running as a systemd service, run sudo ./packaging/install.sh ./process-watcher from the unpacked archive, edit /etc/process-watcher/config.yaml and start it with sudo systemctl enable --now process-watcher. See the README for the configuration and the delivery limits.
Full Changelog: v0.2.1...v0.2.2
process-watcher v0.2.1
process-watcher v0.2.1
Observes the process trees of programs whose executable name contains a configured substring (eBPF, Linux 5.15 or newer with BTF) and logs process creation, exec and exit as JSONL.
What is in a release. One archive per architecture, linux/amd64 and linux/arm64. Each contains process-watcher (a single static binary; the eBPF programs are embedded, nothing else is needed at run time), process-watcher.yaml (the documented example configuration), LICENSE, below php/ the two configurations of the PHP kit (php-observe.yaml observes every PHP runtime, php-fpm-kill-signatures.yaml holds the PHP-FPM response rules and ships as a dry run), usable right after unpacking (the PHP kit has the guide), and in packaging/ the systemd unit with the script that installs it. Every archive is published under two names with the same files: process-watcher_v0.2.1_linux_<arch>.tar.gz (this version) and process-watcher_linux_<arch>.tar.gz (the same name in every release; https://github.com/Neo23x0/process-watcher/releases/latest/download/process-watcher_linux_<arch>.tar.gz serves the newest stable release). SHA256SUMS lists all of them.
Install
ARCH=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/') # amd64 or arm64
curl -fsSLO https://github.com/Neo23x0/process-watcher/releases/download/v0.2.1/process-watcher_v0.2.1_linux_${ARCH}.tar.gz
curl -fsSLO https://github.com/Neo23x0/process-watcher/releases/download/v0.2.1/SHA256SUMS
sha256sum --check --ignore-missing SHA256SUMS
tar xzf process-watcher_v0.2.1_linux_${ARCH}.tar.gz
cd process-watcher_v0.2.1_linux_${ARCH}
sudo ./process-watcher doctor # kernel, BTF, permissions
sudoedit process-watcher.yaml # set watch.image_contains
sudo ./process-watcher # finds process-watcher.yaml next to the binaryThe binary needs root (or CAP_BPF and CAP_PERFMON) and the host's PID namespace. To keep it running as a systemd service, run sudo ./packaging/install.sh ./process-watcher from the unpacked archive, edit /etc/process-watcher/config.yaml and start it with sudo systemctl enable --now process-watcher. See the README for the configuration and the delivery limits.
Full Changelog: v0.2.0...v0.2.1
process-watcher v0.2.0
process-watcher v0.2.0
Observes the process trees of programs whose executable name contains a configured substring (eBPF, Linux 5.15 or newer with BTF) and logs process creation, exec and exit as JSONL.
What is in a release. One archive per architecture, linux/amd64 and linux/arm64. Each contains process-watcher (a single static binary; the eBPF programs are embedded, nothing else is needed at run time), process-watcher.yaml (the documented example configuration), LICENSE, below php/ the two configurations of the PHP kit (php-observe.yaml observes every PHP runtime, php-fpm-kill-signatures.yaml holds the PHP-FPM response rules and ships as a dry run), usable right after unpacking (the PHP kit has the guide), and in packaging/ the systemd unit with the script that installs it. Every archive is published under two names with the same files: process-watcher_v0.2.0_linux_<arch>.tar.gz (this version) and process-watcher_linux_<arch>.tar.gz (the same name in every release; https://github.com/Neo23x0/process-watcher/releases/latest/download/process-watcher_linux_<arch>.tar.gz serves the newest stable release). SHA256SUMS lists all of them.
Install
ARCH=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/') # amd64 or arm64
curl -fsSLO https://github.com/Neo23x0/process-watcher/releases/download/v0.2.0/process-watcher_v0.2.0_linux_${ARCH}.tar.gz
curl -fsSLO https://github.com/Neo23x0/process-watcher/releases/download/v0.2.0/SHA256SUMS
sha256sum --check --ignore-missing SHA256SUMS
tar xzf process-watcher_v0.2.0_linux_${ARCH}.tar.gz
cd process-watcher_v0.2.0_linux_${ARCH}
sudo ./process-watcher doctor # kernel, BTF, permissions
sudoedit process-watcher.yaml # set watch.image_contains
sudo ./process-watcher # finds process-watcher.yaml next to the binaryThe binary needs root (or CAP_BPF and CAP_PERFMON) and the host's PID namespace. To keep it running as a systemd service, run sudo ./packaging/install.sh ./process-watcher from the unpacked archive, edit /etc/process-watcher/config.yaml and start it with sudo systemctl enable --now process-watcher. See the README for the configuration and the delivery limits.
What's Changed
New Contributors
Full Changelog: v0.1.0...v0.2.0
Contributors
Assets 7
process-watcher v0.1.0
process-watcher v0.1.0
Observes the process trees of programs whose executable name contains a configured substring (eBPF, Linux 5.15 or newer with BTF) and logs process creation, exec and exit as JSONL.
What is in a release. One archive per architecture, linux/amd64 and linux/arm64. Each contains exactly three files: process-watcher (a single static binary; the eBPF programs are embedded, nothing else is needed at run time), process-watcher.yaml (the documented example configuration) and LICENSE. SHA256SUMS lists the archives.
Install
ARCH=amd64 # or arm64
curl -fsSLO https://github.com/Neo23x0/process-watcher/releases/download/v0.1.0/process-watcher_v0.1.0_linux_${ARCH}.tar.gz
curl -fsSLO https://github.com/Neo23x0/process-watcher/releases/download/v0.1.0/SHA256SUMS
sha256sum --check --ignore-missing SHA256SUMS
tar xzf process-watcher_v0.1.0_linux_${ARCH}.tar.gz
cd process-watcher_v0.1.0_linux_${ARCH}
sudo ./process-watcher doctor # kernel, BTF, permissions
sudoedit process-watcher.yaml # set watch.image_contains
sudo ./process-watcher # finds process-watcher.yaml next to the binaryThe binary needs root (or CAP_BPF and CAP_PERFMON) and the host's PID namespace. See the README for the configuration, the systemd service and the delivery limits.
Full Changelog: https://github.com/Neo23x0/process-watcher/commits/v0.1.0