process-watcher v0.1.0

process-watcher v0.1.0

Observes the process trees of programs whose executable name contains a configured substring (eBPF, Linux 5.15 or newer with BTF) and logs process creation, exec and exit as JSONL.

What is in a release. One archive per architecture, linux/amd64 and linux/arm64. Each contains exactly three files: process-watcher (a single static binary; the eBPF programs are embedded, nothing else is needed at run time), process-watcher.yaml (the documented example configuration) and LICENSE. SHA256SUMS lists the archives.

Install

ARCH=amd64    # or arm64
curl -fsSLO https://github.com/Neo23x0/process-watcher/releases/download/v0.1.0/process-watcher_v0.1.0_linux_${ARCH}.tar.gz
curl -fsSLO https://github.com/Neo23x0/process-watcher/releases/download/v0.1.0/SHA256SUMS
sha256sum --check --ignore-missing SHA256SUMS
tar xzf process-watcher_v0.1.0_linux_${ARCH}.tar.gz
cd process-watcher_v0.1.0_linux_${ARCH}
sudo ./process-watcher doctor          # kernel, BTF, permissions
sudoedit process-watcher.yaml          # set watch.image_contains
sudo ./process-watcher                 # finds process-watcher.yaml next to the binary

The binary needs root (or CAP_BPF and CAP_PERFMON) and the host's PID namespace. See the README for the configuration, the systemd service and the delivery limits.

---

Full Changelog: https://github.com/Neo23x0/process-watcher/commits/v0.1.0