Filetrace 26.11.7.4

26.11.7.4 (2026-11-12)

Bug Fix

• Forget a script id in the kernel when its name loses its slot (7c5104c)
• Open PHP libraries as mapped and probe each real file once (80a2668)
• Log the path and process of each probed PHP binary (1eb91c6)

Every change

Filetrace 26.11.6.5

26.11.6.5 (2026-11-12)

New Feature

• Name the script of each PHP request from probes on PHP (6f12780)

Every change

Filetrace 26.11.5.6

26.11.5.6 (2026-11-12)

New Feature

• Report a PID namespace other than the host's in doctor (b69be3f)

Bug Fix

• Take the command line and directory from the exec record (5dd7e0b)
• Skip /proc reads outside the host PID namespace (310560c)

Every change

Filetrace 26.11.4.16

26.11.4.16 (2026-11-11)

New Feature

• Derive the script an interpreter runs from its arguments (d750911)
• Keep the command line, directory and script of each process (56f20aa)
• Show command line, directory and script in listings (e9b53f8)
• Filter processes, transfers and events by script (8ab3862)
• Export what a process runs in OTLP log records (606ffd4)
• Serve the command line, directory and script over gRPC (cce3858)
• Add settings that keep process arguments out (2bfa362)

Every change

Filetrace 26.11.3.4

26.11.3.4 (2026-11-11)

Bug Fix

• Keep reads of background files from taking over a send (758c198)
• Learn background files from the paths the kernel reports (36fed69)

Every change

Filetrace 26.11.2.11

26.11.2.11 (2026-11-11)

New Feature

• Report files in no_minimum_paths below the inferred minimums (eebbfc6)

Bug Fix

• Send only the exact installer and key paths to the bucket (ba947c3)
• Answer a failed precondition by the body R2 leaves undefined (aa35b66)
• Install the libraries the agent links to in the vm image (21248e3)
• Let a receive end the file claim of the kprobe set (78e461a)
• Refuse a channel without a release before configuring a repository (9142f85)
• Let a receive on any socket end the file claim of the kprobe set (3cba2b8)
• Check a channel where the chosen install method reads it (43e5839)

Every change

Filetrace 26.11.1.160

26.11.1.160 (2026-11-11)

New Feature

• Add core data model and bounded tables (9a70918)
• Add observation state and queries (7130fd4)
• Add ipc client (e9cdb16)
• Add collection backend interface (45fd255)
• Add linux ebpf probes (b353d8e)
• Add linux ebpf loader and diagnostics (61e2dc6)
• Add daemon with local query socket (5aa3aba)
• Add command-line interface (b4c57e7)
• Trace through kprobes on kernels without bpf trampolines (3094b53)
• Record file size, file owner and network namespace (1d40e1c)
• Report byte rates per process, socket, flow and transfer (8bd638d)
• Match remote and local addresses by network prefix (ba1f5e2)
• Filter files by path regex and by file size (637e89c)
• Sort by duration, process name and file path (cf2096f)
• Add json and jsonl shorthand flags (6e3beaa)
• Give flows stable ids and query by socket or flow (9be93d9)
• Count distinct files and active transfers per process (30a3427)
• Name transfer methods as the cli contract does (68f5ce8)
• Name output fields as the cli contract does (feb1a29)
• Lay out list tables as the cli contract shows them (8ea9def)
• Keep a bounded log of events and add the events command (803862f)
• Add inspect for files, processes, sockets, flows and addresses (61a1599)
• Filter sockets, flows and transfers by user, cgroup and namespace (689c15e)
• Rebuild watch with file, process and network views (1a0ad7c)
• Let the collector ignore protocols, processes and paths (440ec6b)
• Let the backend skip the read and sendfile probes (c0ab1a2)
• Read settings from a configuration file (1912867)
• Report system facts, probes, features and pipeline in doctor (42ee6df)
• Show agent status and the main commands for a bare filetrace (009a63f)
• Show remote addresses by host name on request (436c8aa)
• Count sent bytes and transfers per process for export (1dec552)
• Serve metrics to prometheus (1730ae2)
• Add a grpc client and server over nghttp2 (f5b9bb6)
• Export events and metrics over otlp (b0da574)
• Define the grpc api in protobuf (23a3b23)
• Serve status and transfers over grpc (c2d2636)
• Derive the release version from git tags (91d4e2c)
• Report the version derived from git tags (b8fe3d5)
• Print the commit in filetrace version (c5c5def)
• Add --version to filetrace-agent (332aeae)
• Add an option to link third-party libraries statically (3c98b1e)
• Add a default configuration file for packages (6d9479d)
• Add service definitions for systemd, openrc and sysv init (d228de9)
• Add maintainer scripts shared by deb, rpm and apk (a4a001d)
• Build tarballs and deb, rpm and apk packages (808a80e)
• Add an installer script (283d022)
• Build macos release binaries (3f0b3a7)
• Sign the rpm and apk packages when keys are given (c573b87)
• Build signed apt, yum and apk repositories (2e70496)
• Let apt fetch the repository indexes by checksum (6345da2)
• Serve the files of every release from the download site (2a79de5)
• Add a script that uploads the download site to r2 (a4f4ae2)
• Point the installer at filetrace.eorlov.org (e271c3b)
• Print a keg-only homebrew formula for a release line (b270b9b)
• Write the formula of the line to the tap on every release (79f1625)
• Serve the docs and the downloads through one worker (da6ec93)

Performance Improvement

• Skip draining counter maps that received no entries (21f2168)
• Use a smaller event queue in minimal mode (cfd462b)

Bug Fix

• Omit processes without traffic from ranked views (3234f9f)
• Tell apart files that reuse a deleted inode number (766f92b)
• Keep a foreground collector from serving metrics (7d3a905)
• Reconnect at once after an idle grpc connection closes (7f6086a)
• Widen the version field of the stats row (36312dd)
• Set file modes explicitly in the release archives (e79579d)
• Make the installer upgrade from its own repository (ffa6d1d)
• Deploy the download site when its build succeeded (b85fc6e)
• Name the x86 registers as t...

Filetrace 26.11.1.145

26.11.1.145 (2026-11-11)

New Feature

• Add core data model and bounded tables (9a70918)
• Add observation state and queries (7130fd4)
• Add ipc client (e9cdb16)
• Add collection backend interface (45fd255)
• Add linux ebpf probes (b353d8e)
• Add linux ebpf loader and diagnostics (61e2dc6)
• Add daemon with local query socket (5aa3aba)
• Add command-line interface (b4c57e7)
• Trace through kprobes on kernels without bpf trampolines (3094b53)
• Record file size, file owner and network namespace (1d40e1c)
• Report byte rates per process, socket, flow and transfer (8bd638d)
• Match remote and local addresses by network prefix (ba1f5e2)
• Filter files by path regex and by file size (637e89c)
• Sort by duration, process name and file path (cf2096f)
• Add json and jsonl shorthand flags (6e3beaa)
• Give flows stable ids and query by socket or flow (9be93d9)
• Count distinct files and active transfers per process (30a3427)
• Name transfer methods as the cli contract does (68f5ce8)
• Name output fields as the cli contract does (feb1a29)
• Lay out list tables as the cli contract shows them (8ea9def)
• Keep a bounded log of events and add the events command (803862f)
• Add inspect for files, processes, sockets, flows and addresses (61a1599)
• Filter sockets, flows and transfers by user, cgroup and namespace (689c15e)
• Rebuild watch with file, process and network views (1a0ad7c)
• Let the collector ignore protocols, processes and paths (440ec6b)
• Let the backend skip the read and sendfile probes (c0ab1a2)
• Read settings from a configuration file (1912867)
• Report system facts, probes, features and pipeline in doctor (42ee6df)
• Show agent status and the main commands for a bare filetrace (009a63f)
• Show remote addresses by host name on request (436c8aa)
• Count sent bytes and transfers per process for export (1dec552)
• Serve metrics to prometheus (1730ae2)
• Add a grpc client and server over nghttp2 (f5b9bb6)
• Export events and metrics over otlp (b0da574)
• Define the grpc api in protobuf (23a3b23)
• Serve status and transfers over grpc (c2d2636)
• Derive the release version from git tags (91d4e2c)
• Report the version derived from git tags (b8fe3d5)
• Print the commit in filetrace version (c5c5def)
• Add --version to filetrace-agent (332aeae)
• Add an option to link third-party libraries statically (3c98b1e)
• Add a default configuration file for packages (6d9479d)
• Add service definitions for systemd, openrc and sysv init (d228de9)
• Add maintainer scripts shared by deb, rpm and apk (a4a001d)
• Build tarballs and deb, rpm and apk packages (808a80e)
• Add an installer script (283d022)
• Build macos release binaries (3f0b3a7)
• Sign the rpm and apk packages when keys are given (c573b87)
• Build signed apt, yum and apk repositories (2e70496)
• Let apt fetch the repository indexes by checksum (6345da2)
• Serve the files of every release from the download site (2a79de5)
• Add a script that uploads the download site to r2 (a4f4ae2)
• Point the installer at filetrace.eorlov.org (e271c3b)
• Print a keg-only homebrew formula for a release line (b270b9b)
• Write the formula of the line to the tap on every release (79f1625)

Performance Improvement

• Skip draining counter maps that received no entries (21f2168)
• Use a smaller event queue in minimal mode (cfd462b)

Bug Fix

• Omit processes without traffic from ranked views (3234f9f)
• Tell apart files that reuse a deleted inode number (766f92b)
• Keep a foreground collector from serving metrics (7d3a905)
• Reconnect at once after an idle grpc connection closes (7f6086a)
• Widen the version field of the stats row (36312dd)
• Set file modes explicitly in the release archives (e79579d)
• Make the installer upgrade from its own repository (ffa6d1d)
• Deploy the download site when its build succeeded (b85fc6e)
• Name the x86 registers as the kernel does in the kprobe programs (2bf4201)
• Let the publis...