search

e-dant / watcher

Filesystem watcher. Works anywhere. Simple, efficient and friendly.
MIT License
639 stars 32 forks source link

Watch proc with ebpf #42

Open e-dant opened 9 months ago

e-dant commented 9 months ago

One of the only filesystems we can't watch is the virtual /proc filesystem on Linux.

There is a way to create an ebpf program for the kernel to run which lets us know about modification events on those paths.

e-dant commented 3 months ago

https://github.com/e-dant/watcher-bpf-experimental