{"id":293,"date":"2024-06-25T16:13:12","date_gmt":"2024-06-25T08:13:12","guid":{"rendered":"https:\/\/www.swreader.com\/?p=293"},"modified":"2024-06-25T16:36:11","modified_gmt":"2024-06-25T08:36:11","slug":"build-and-debug-ebpf-project-tetragon","status":"publish","type":"post","link":"https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/","title":{"rendered":"eBPF Tetragon Compilation and Debugging Guide"},"content":{"rendered":"<p>This article provides a introduction to compiling and debugging with the eBPF-based Tetragon tool. It covers configuring Vagrant and VirtualBox, methods for capturing and analyzing eBPF events using Tetragon and Tetra, as well as compiling Tetragon in Docker and debugging in Kubernetes clusters.<\/p>\n<h2>Debugging Dependencies<\/h2>\n<p>The Tetragon GitHub documentation specifies that debugging is conducted within VirtualBox. Therefore, <strong>before starting debugging, you need to install Vagrant and VirtualBox<\/strong>.<\/p>\n<p>The Tetragon source code provides a Vagrant configuration. When starting VirtualBox via Vagrant, it will automatically install all dependencies and tools. For details, refer to the Tetragon source code.<\/p>\n<h2>Starting the Virtual Machine<\/h2>\n<p>Start and log in to the VirtualBox virtual machine with the following commands:<\/p>\n<pre><code class=\"language-bash\">vagrant up\nvagrant ssh<\/code><\/pre>\n<p>On some older versions of Vagrant, <code>vagrant up<\/code> may throw an error. In such cases, you can try removing the disk configuration and retrying:<\/p>\n<pre><code class=\"language-git\">diff --git a\/Vagrantfile b\/Vagrantfile\n--- a\/Vagrantfile\n+++ b\/Vagrantfile\n@@ -1,6 +1,5 @@\n Vagrant.configure(&quot;2&quot;) do |config|\n   config.vm.box = &quot;ubuntu\/impish64&quot;\n-  config.vm.disk :disk, size: &quot;50GB&quot;\n   config.vm.provision :docker<\/code><\/pre>\n<h2>Local Compilation<\/h2>\n<ul>\n<li>First, install the dependencies for LLVM and libbpf:<\/li>\n<\/ul>\n<pre><code class=\"language-bash\">make tools-install<\/code><\/pre>\n<ul>\n<li>Then, compile the BPF programs and Go programs:<\/li>\n<\/ul>\n<pre><code class=\"language-bash\">LD_LIBRARY_PATH=$(realpath .\/lib) make<\/code><\/pre>\n<p>This command will compile all executable programs and test programs. To improve efficiency during debugging, you can compile only <strong>tetra and tetragon<\/strong>:<\/p>\n<pre><code class=\"language-bash\">LD_LIBRARY_PATH=$(realpath .\/lib) make tetra tetragon<\/code><\/pre>\n<p>You will then see the locally generated <code>tetragon<\/code> and <code>tetra<\/code> programs. The purpose of these two programs will be explained later.<\/p>\n<pre><code class=\"language-bash\"> ls tetra*\ntetra tetragon tetragon-alignchecker<\/code><\/pre>\n<h2>Local Debugging<\/h2>\n<h3>Starting Tetragon<\/h3>\n<p>When starting, you need to specify the path of the eBPF <code>.o<\/code> files and the Tetragon library:<\/p>\n<pre><code class=\"language-bash\">sudo LD_LIBRARY_PATH=$(realpath .\/lib) .\/tetragon --bpf-lib bpf\/objs<\/code><\/pre>\n<p>Once Tetragon starts, it will load the eBPF programs and wait for listener connections on the specified port (default is <strong>localhost:54321<\/strong>). After a listener connects, Tetragon will forward the detected events to the listener.<\/p>\n<p>The Tetragon startup log looks like this:<\/p>\n<pre><code class=\"language-log\">time=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;Starting tetragon&quot; version=v0.8.0-106-g5c3fd60\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;config settings&quot; \n     config=&quot;map[bpf-lib:bpf\/objs btf: cilium-bpf: config-dir: config-file: debug:false enable-cilium-api:false enable-export-aggregation:false enable-k8s-api:false enable-process-ancestors:true enable-process-cred:false enable-process-ns:false export-aggregation-buffer-size:10000 export-aggregation-window-size:15s export-allowlist: export-denylist: export-file-compress:false export-file-max-backups:5 export-file-max-size-mb:10 export-file-rotation-interval:0s export-filename: export-rate-limit:-1 force-small-progs:false ignore-missing-progs:false kernel: log-format:text log-level:info metrics-server: netns-dir:\/var\/run\/docker\/netns\/ process-cache-size:65536 procfs:\/proc\/ run-standalone:false server-address:localhost:54321 verbose:0]&quot;\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;Available sensors&quot; sensors=\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;Registered tracing sensors&quot; sensors=&quot;kprobe sensor, tracepoint sensor&quot;\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;Registered probe types&quot; types=&quot;tracepoint sensor, kprobe sensor&quot;\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;Disabling Kubernetes API&quot;\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;Disabling Cilium API&quot;\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;Starting process manager&quot; enableCilium=false enableEventCache=false enableProcessCred=false enableProcessNs=false\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;Exporter configuration&quot; enabled=false fileName=\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;Using metadata file&quot; metadata=\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;Loading sensor&quot; name=__main__\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;Loading kernel version 5.13.19&quot;\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;Starting gRPC server&quot; address=&quot;localhost:54321&quot;\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;tetragon, map loaded.&quot; map=execve_map path=\/sys\/fs\/bpf\/tcpmon\/execve_map sensor=__main__\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;tetragon, map loaded.&quot; map=execve_map_stats path=\/sys\/fs\/bpf\/tcpmon\/execve_map_stats sensor=__main__\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;tetragon, map loaded.&quot; map=names_map path=\/sys\/fs\/bpf\/tcpmon\/names_map sensor=__main__\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;tetragon, map loaded.&quot; map=tcpmon_map path=\/sys\/fs\/bpf\/tcpmon\/tcpmon_map sensor=__main__\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;BPF prog was loaded&quot; label=tracepoint\/sys_exit prog=bpf\/objs\/bpf_exit.o\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;BPF prog was loaded&quot; label=kprobe\/wake_up_new_task prog=bpf\/objs\/bpf_fork.o\ntime=&quot;2022-05-29T10:37:56Z&quot; level=info msg=&quot;Load probe&quot; Program=bpf\/objs\/bpf_execve_event_v53.o Type=execve\ntime=&quot;2022-05-29T10:37:57Z&quot; level=info msg=&quot;Read ProcFS \/proc\/ appended 74\/218 entries&quot;\ntime=&quot;2022-05-29T10:37:57Z&quot; level=warning msg=&quot;Procfs execve event pods\/ identifier error&quot; error=&quot;open \/proc\/0\/cgroup: no such file or directory&quot;\ntime=&quot;2022-05-29T10:37:57Z&quot; level=info msg=&quot;BPF prog was loaded&quot; label=tracepoint\/sys_execve prog=bpf\/objs\/bpf_execve_event_v53.o\ntime=&quot;2022-05-29T10:37:57Z&quot; level=info msg=&quot;Loaded BPF maps and events for sensor successfully&quot; sensor=__main__\ntime=&quot;2022-05-29T10:37:57Z&quot; level=info msg=&quot;Listening for events...&quot;<\/code><\/pre>\n<p>From the log, you can see the <strong>Tetragon startup config parameters<\/strong> (second line), the Tetragon version, and more.<\/p>\n<h3>Changing the Default Log Level<\/h3>\n<p>From the config parameters, you can see that the default log level is <code>info<\/code>. To change the log level to <code>debug<\/code>, add the <strong>&#8211;log-level=debug<\/strong> parameter at startup:<\/p>\n<pre><code class=\"language-bash\">sudo LD_LIBRARY_PATH=$(realpath .\/lib) .\/tetragon --bpf-lib bpf\/objs --log-level=debug<\/code><\/pre>\n<h3>Starting the Listener: Tetra<\/h3>\n<p>Tetra is a CLI debugging tool for Tetragon. You can see the specific parameters and usage of Tetra by directly running <code>tetra<\/code>:<\/p>\n<pre><code class=\"language-bash\">Tetragon CLI\n\nUsage:\n  tetra [flags]\n  tetra [command]\n\nAvailable Commands:\n  bugtool         Produce a tar archive with debug information\n  getevents       Print events\n  help            Help about any command\n  sensors         Manage sensors\n  stacktrace-tree Manage stacktrace trees\n  status          Print health status\n  tracingpolicy   Manage tracing policies\n  version         Print version\n\nFlags:\n  -d, --debug                   Enable debug messages\n  -h, --help                    help for tetra\n      --server-address string   gRPC server address (default &quot;localhost:54321&quot;)\n\nUse &quot;tetra [command] --help&quot; for more information about a command.<\/code><\/pre>\n<p>You can retrieve eBPF events sent by Tetragon using <strong>tetra getevents<\/strong>. By default, Tetra outputs in JSON format, for example:<\/p>\n<pre><code class=\"language-bash\">$ .\/tetra getevents | jq &quot;.&quot;\n{\n  &quot;process_exec&quot;: {\n    &quot;process&quot;: {\n      &quot;exec_id&quot;: &quot;OjI0Njk4Mjk4ODYxNDI6MTI0NDE=&quot;,\n      &quot;pid&quot;: 12441,\n      &quot;uid&quot;: 0,\n      &quot;cwd&quot;: &quot;\/run\/containerd\/io.containerd.runtime.v2.task\/k8s.io\/25ecffd7e2ee833292350\n\n0bd930eaebe2725bb643e7e9e2206b611f8666abac0\/&quot;,\n      &quot;binary&quot;: &quot;\/usr\/local\/sbin\/runc&quot;,\n      &quot;arguments&quot;: &quot;--root \/run\/containerd\/runc\/k8s.io --log \/run\/containerd\/io.containerd.runtime.v2.task\/k8s.io\/c7c9f733b618c7b46f0bd86e054fc5d940fbd7eb627cf009d6d9cd0584c846a6\/log.json --log-format json exec --process \/tmp\/runc-process789407863 --detach --pid-file \/run\/containerd\/io.containerd.runtime.v2.task\/k8s.io\/c7c9f733b618c7b46f0bd86e054fc5d940fbd7eb627cf009d6d9cd0584c846a6\/4c9ea3805e0d2a23de4c0cdb983c52db832689aa821d3363ba8954b1b76359d9.pid c7c9f733b618c7b46f0bd86e054fc5d940fbd7eb627cf009d6d9cd0584c846a6&quot;,\n      &quot;flags&quot;: &quot;execve clone&quot;,\n      &quot;start_time&quot;: &quot;2022-05-29T10:54:19.452Z&quot;,\n      &quot;auid&quot;: 4294967295,\n      &quot;parent_exec_id&quot;: &quot;OjMzMzgwMDAwMDAwOjI0NzM=&quot;,\n      &quot;refcnt&quot;: 1\n    },\n    &quot;parent&quot;: {\n      &quot;exec_id&quot;: &quot;OjMzMzgwMDAwMDAwOjI0NzM=&quot;,\n      &quot;pid&quot;: 2473,\n      &quot;uid&quot;: 0,\n      &quot;cwd&quot;: &quot;\/run\/containerd\/io.containerd.runtime.v2.task\/k8s.io\/25ecffd7e2ee8332923500bd930eaebe2725bb643e7e9e2206b611f8666abac0&quot;,\n      &quot;binary&quot;: &quot;\/usr\/local\/bin\/containerd-shim-runc-v2&quot;,\n      &quot;arguments&quot;: &quot;-namespace k8s.io -id 25ecffd7e2ee8332923500bd930eaebe2725bb643e7e9e2206b611f8666abac0 -address \/run\/containerd\/containerd.sock&quot;,\n      &quot;flags&quot;: &quot;procFS auid&quot;,\n      &quot;start_time&quot;: &quot;2022-05-29T10:13:43.002Z&quot;,\n      &quot;auid&quot;: 0,\n      &quot;parent_exec_id&quot;: &quot;OjIyODIwMDAwMDAwOjExOTE=&quot;,\n      &quot;refcnt&quot;: 4294967265\n    }\n  },\n  &quot;time&quot;: &quot;2022-05-29T10:54:19.452Z&quot;\n}<\/code><\/pre>\n<p>Using <strong>tetra getevents &#8211;output compact<\/strong> provides a more user-friendly output:<\/p>\n<pre><code class=\"language-bash\">.\/tetra getevents --output compact\n\ud83d\ude80 process  \/usr\/sbin\/iptables -w 5 -W 100000 -S KUBE-KUBELET-CANARY -t mangle \n\ud83d\udca5 exit     \/usr\/sbin\/iptables -w 5 -W 100000 -S KUBE-KUBELET-CANARY -t mangle 0 \n\ud83d\ude80 process  \/usr\/sbin\/ip6tables -w 5 -W 100000 -S KUBE-KUBELET-CANARY -t mangle \n\ud83d\udca5 exit     \/usr\/sbin\/ip6tables -w 5 -W 100000 -S KUBE-KUBELET-CANARY -t mangle 0 <\/code><\/pre>\n<h2>Compiling in Docker<\/h2>\n<p>To compile in Docker, use the following commands. By default, Docker images will be packaged. Refer to the Makefile for details.<\/p>\n<pre><code class=\"language-bash\"># Build Tetragon agent and operator images\nLD_LIBRARY_PATH=$(realpath .\/lib) make LOCAL_CLANG=0 image image-operator\n\n# Bootstrap the cluster\ncontrib\/localdev\/bootstrap-kind-cluster.sh\n\n# Install Tetragon\ncontrib\/localdev\/install-tetragon.sh --image cilium\/tetragon:latest --operator cilium\/tetragon-operator:latest<\/code><\/pre>\n<p>This process may take some time because it will install the kind tool and set up a single-node Kubernetes cluster using kind.<\/p>\n<p>After compiling, Tetragon will be deployed in the Kubernetes cluster. You can check this with the kubectl command:<\/p>\n<pre><code>kubectl get pods -n kube-system<\/code><\/pre>\n<h2>Debugging in the Kubernetes Cluster<\/h2>\n<p>After deploying Tetragon in the Kubernetes cluster, you can check the event reports with the following command. The output log will be quite extensive (in JSON format), and you can use the <code>jq<\/code> command for log filtering.<\/p>\n<pre><code>kubectl logs -n kube-system ds\/tetragon -c export-stdout -f<\/code><\/pre>\n<p>reference <a href=\"https:\/\/github.com\/cilium\/tetragon\" title=\"tetragon\">tetragon<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This article provides a introduction to compiling and debugging with the eBPF-based Tetragon tool. It covers configuring Vagrant and VirtualBox, methods for capturing and analyzing eBPF events using Tetragon and Tetra, as well as compiling Tetragon in Docker and debugging in Kubernetes clusters. Debugging Dependencies The Tetragon GitHub documentation specifies that debugging is conducted within VirtualBox. Therefore, before starting debugging, you need to install Vagrant and VirtualBox. The Tetragon source code provides a Vagrant configuration. When starting VirtualBox via Vagrant, it will automatically install all dependencies and tools. For details, refer to the Tetragon source code. Starting the Virtual Machine Start and log in to the VirtualBox virtual machine with the following commands: vagrant up vagrant ssh On some older versions of Vagrant, vagrant up may throw an error. In such cases, you can try removing the disk configuration and retrying: diff &#8211;git a\/Vagrantfile b\/Vagrantfile &#8212; a\/Vagrantfile +++ b\/Vagrantfile @@ -1,6 +1,5 @@ Vagrant.configure(&quot;2&quot;) do |config| config.vm.box = &quot;ubuntu\/impish64&quot; &#8211; config.vm.disk :disk, size: &quot;50GB&quot; config.vm.provision :docker Local Compilation First, install the dependencies for LLVM and libbpf: make tools-install Then, compile the BPF programs and Go programs: LD_LIBRARY_PATH=$(realpath .\/lib) make This command will compile all executable programs and test programs. To improve efficiency during debugging, you can compile only tetra and tetragon: LD_LIBRARY_PATH=$(realpath .\/lib) make tetra tetragon You will then see the locally generated tetragon and tetra programs. The purpose of these two programs will be explained later. ls tetra* tetra tetragon tetragon-alignchecker Local Debugging Starting Tetragon When starting, you need to specify the path of the eBPF .o files and the Tetragon library: sudo LD_LIBRARY_PATH=$(realpath .\/lib) .\/tetragon &#8211;bpf-lib bpf\/objs Once Tetragon starts, it wil&#8230;<\/p>\n","protected":false},"author":1,"featured_media":295,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","fifu_image_url":"https:\/\/miro.medium.com\/v2\/resize:fit:2000\/1*OdYWJV-jko9hiYBb9er6qQ.png","fifu_image_alt":"Tetragon ebpf","footnotes":""},"categories":[237,162,66],"tags":[249,239,171,173,251,175,247,73,245,253,241,243],"class_list":["post-293","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ebpf-en","category-kubernetes","category-linux-en","tag-bpf","tag-debugging","tag-docker-en","tag-ebpf-en","tag-go-programming","tag-kubernetes-en","tag-libbpf","tag-linux-en","tag-llvm","tag-tetragon-en","tag-vagrant","tag-virtualbox"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>eBPF Tetragon Compilation and Debugging Guide - TianYa Blog %<\/title>\n<meta name=\"description\" content=\"This article provides a introduction to compiling and debugging with the eBPF-based Tetragon tool. It covers configuring Vagrant and VirtualBox, methods for capturing and analyzing eBPF events using Tetragon and Tetra, as well as compiling Tetragon in Docker and debugging in Kubernetes clusters.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"eBPF Tetragon Compilation and Debugging Guide - TianYa Blog %\" \/>\n<meta property=\"og:description\" content=\"This article provides a introduction to compiling and debugging with the eBPF-based Tetragon tool. It covers configuring Vagrant and VirtualBox, methods for capturing and analyzing eBPF events using Tetragon and Tetra, as well as compiling Tetragon in Docker and debugging in Kubernetes clusters.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/\" \/>\n<meta property=\"og:site_name\" content=\"TianYa Blog\" \/>\n<meta property=\"article:published_time\" content=\"2024-06-25T08:13:12+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-06-25T08:36:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/miro.medium.com\/v2\/resize:fit:2000\/1*OdYWJV-jko9hiYBb9er6qQ.png\" \/><meta property=\"og:image\" content=\"https:\/\/miro.medium.com\/v2\/resize:fit:2000\/1*OdYWJV-jko9hiYBb9er6qQ.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"765\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"zdm\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/miro.medium.com\/v2\/resize:fit:2000\/1*OdYWJV-jko9hiYBb9er6qQ.png\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"zdm\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.swreader.com\\\/index.php\\\/en\\\/2024\\\/06\\\/25\\\/build-and-debug-ebpf-project-tetragon\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.swreader.com\\\/index.php\\\/en\\\/2024\\\/06\\\/25\\\/build-and-debug-ebpf-project-tetragon\\\/\"},\"author\":{\"name\":\"zdm\",\"@id\":\"https:\\\/\\\/www.swreader.com\\\/#\\\/schema\\\/person\\\/9c90501e33afc9307d757bc8cfaf1c6f\"},\"headline\":\"eBPF Tetragon Compilation and Debugging Guide\",\"datePublished\":\"2024-06-25T08:13:12+00:00\",\"dateModified\":\"2024-06-25T08:36:11+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.swreader.com\\\/index.php\\\/en\\\/2024\\\/06\\\/25\\\/build-and-debug-ebpf-project-tetragon\\\/\"},\"wordCount\":472,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.swreader.com\\\/#\\\/schema\\\/person\\\/9c90501e33afc9307d757bc8cfaf1c6f\"},\"image\":{\"@id\":\"https:\\\/\\\/www.swreader.com\\\/index.php\\\/en\\\/2024\\\/06\\\/25\\\/build-and-debug-ebpf-project-tetragon\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/miro.medium.com\\\/v2\\\/resize:fit:2000\\\/1*OdYWJV-jko9hiYBb9er6qQ.png?w=1600&resize=1600,765&ssl=1\",\"keywords\":[\"BPF\",\"Debugging\",\"Docker\",\"Ebpf\",\"Go Programming\",\"Kubernetes\",\"libbpf\",\"linux\",\"LLVM\",\"Tetragon\",\"Vagrant\",\"VirtualBox\"],\"articleSection\":[\"Ebpf\",\"kubernetes\",\"Linux\"],\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.swreader.com\\\/index.php\\\/en\\\/2024\\\/06\\\/25\\\/build-and-debug-ebpf-project-tetragon\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.swreader.com\\\/index.php\\\/en\\\/2024\\\/06\\\/25\\\/build-and-debug-ebpf-project-tetragon\\\/\",\"url\":\"https:\\\/\\\/www.swreader.com\\\/index.php\\\/en\\\/2024\\\/06\\\/25\\\/build-and-debug-ebpf-project-tetragon\\\/\",\"name\":\"eBPF Tetragon Compilation and Debugging Guide - TianYa Blog %\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.swreader.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.swreader.com\\\/index.php\\\/en\\\/2024\\\/06\\\/25\\\/build-and-debug-ebpf-project-tetragon\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.swreader.com\\\/index.php\\\/en\\\/2024\\\/06\\\/25\\\/build-and-debug-ebpf-project-tetragon\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/miro.medium.com\\\/v2\\\/resize:fit:2000\\\/1*OdYWJV-jko9hiYBb9er6qQ.png?w=1600&resize=1600,765&ssl=1\",\"datePublished\":\"2024-06-25T08:13:12+00:00\",\"dateModified\":\"2024-06-25T08:36:11+00:00\",\"description\":\"This article provides a introduction to compiling and debugging with the eBPF-based Tetragon tool. It covers configuring Vagrant and VirtualBox, methods for capturing and analyzing eBPF events using Tetragon and Tetra, as well as compiling Tetragon in Docker and debugging in Kubernetes clusters.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.swreader.com\\\/index.php\\\/en\\\/2024\\\/06\\\/25\\\/build-and-debug-ebpf-project-tetragon\\\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.swreader.com\\\/index.php\\\/en\\\/2024\\\/06\\\/25\\\/build-and-debug-ebpf-project-tetragon\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\\\/\\\/www.swreader.com\\\/index.php\\\/en\\\/2024\\\/06\\\/25\\\/build-and-debug-ebpf-project-tetragon\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/miro.medium.com\\\/v2\\\/resize:fit:2000\\\/1*OdYWJV-jko9hiYBb9er6qQ.png?w=1600&resize=1600,765&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/miro.medium.com\\\/v2\\\/resize:fit:2000\\\/1*OdYWJV-jko9hiYBb9er6qQ.png?w=1600&resize=1600,765&ssl=1\",\"width\":\"1600\",\"height\":\"765\",\"caption\":\"Tetragon ebpf\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.swreader.com\\\/index.php\\\/en\\\/2024\\\/06\\\/25\\\/build-and-debug-ebpf-project-tetragon\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\\\/\\\/www.swreader.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"eBPF Tetragon Compilation and Debugging Guide\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.swreader.com\\\/#website\",\"url\":\"https:\\\/\\\/www.swreader.com\\\/\",\"name\":\"TianYa Blog\",\"description\":\"Technology And Life\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.swreader.com\\\/#\\\/schema\\\/person\\\/9c90501e33afc9307d757bc8cfaf1c6f\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.swreader.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"zh-Hans\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.swreader.com\\\/#\\\/schema\\\/person\\\/9c90501e33afc9307d757bc8cfaf1c6f\",\"name\":\"zdm\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2670c9b6412a56381880b2ca03988f659e8a378fe7332238a4a741b660a60997?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2670c9b6412a56381880b2ca03988f659e8a378fe7332238a4a741b660a60997?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2670c9b6412a56381880b2ca03988f659e8a378fe7332238a4a741b660a60997?s=96&d=mm&r=g\",\"caption\":\"zdm\"},\"logo\":{\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2670c9b6412a56381880b2ca03988f659e8a378fe7332238a4a741b660a60997?s=96&d=mm&r=g\"},\"sameAs\":[\"http:\\\/\\\/www.swreader.com\"],\"url\":\"https:\\\/\\\/www.swreader.com\\\/index.php\\\/author\\\/zdm\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"eBPF Tetragon Compilation and Debugging Guide - TianYa Blog %","description":"This article provides a introduction to compiling and debugging with the eBPF-based Tetragon tool. It covers configuring Vagrant and VirtualBox, methods for capturing and analyzing eBPF events using Tetragon and Tetra, as well as compiling Tetragon in Docker and debugging in Kubernetes clusters.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/","og_locale":"zh_CN","og_type":"article","og_title":"eBPF Tetragon Compilation and Debugging Guide - TianYa Blog %","og_description":"This article provides a introduction to compiling and debugging with the eBPF-based Tetragon tool. It covers configuring Vagrant and VirtualBox, methods for capturing and analyzing eBPF events using Tetragon and Tetra, as well as compiling Tetragon in Docker and debugging in Kubernetes clusters.","og_url":"https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/","og_site_name":"TianYa Blog","article_published_time":"2024-06-25T08:13:12+00:00","article_modified_time":"2024-06-25T08:36:11+00:00","og_image":[{"url":"https:\/\/miro.medium.com\/v2\/resize:fit:2000\/1*OdYWJV-jko9hiYBb9er6qQ.png","type":"","width":"","height":""},{"width":1600,"height":765,"url":"https:\/\/miro.medium.com\/v2\/resize:fit:2000\/1*OdYWJV-jko9hiYBb9er6qQ.png","type":"image\/jpeg"}],"author":"zdm","twitter_card":"summary_large_image","twitter_image":"https:\/\/miro.medium.com\/v2\/resize:fit:2000\/1*OdYWJV-jko9hiYBb9er6qQ.png","twitter_misc":{"\u4f5c\u8005":"zdm","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"3 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/#article","isPartOf":{"@id":"https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/"},"author":{"name":"zdm","@id":"https:\/\/www.swreader.com\/#\/schema\/person\/9c90501e33afc9307d757bc8cfaf1c6f"},"headline":"eBPF Tetragon Compilation and Debugging Guide","datePublished":"2024-06-25T08:13:12+00:00","dateModified":"2024-06-25T08:36:11+00:00","mainEntityOfPage":{"@id":"https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/"},"wordCount":472,"commentCount":0,"publisher":{"@id":"https:\/\/www.swreader.com\/#\/schema\/person\/9c90501e33afc9307d757bc8cfaf1c6f"},"image":{"@id":"https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/miro.medium.com\/v2\/resize:fit:2000\/1*OdYWJV-jko9hiYBb9er6qQ.png?w=1600&resize=1600,765&ssl=1","keywords":["BPF","Debugging","Docker","Ebpf","Go Programming","Kubernetes","libbpf","linux","LLVM","Tetragon","Vagrant","VirtualBox"],"articleSection":["Ebpf","kubernetes","Linux"],"inLanguage":"zh-Hans","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/","url":"https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/","name":"eBPF Tetragon Compilation and Debugging Guide - TianYa Blog %","isPartOf":{"@id":"https:\/\/www.swreader.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/#primaryimage"},"image":{"@id":"https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/miro.medium.com\/v2\/resize:fit:2000\/1*OdYWJV-jko9hiYBb9er6qQ.png?w=1600&resize=1600,765&ssl=1","datePublished":"2024-06-25T08:13:12+00:00","dateModified":"2024-06-25T08:36:11+00:00","description":"This article provides a introduction to compiling and debugging with the eBPF-based Tetragon tool. It covers configuring Vagrant and VirtualBox, methods for capturing and analyzing eBPF events using Tetragon and Tetra, as well as compiling Tetragon in Docker and debugging in Kubernetes clusters.","breadcrumb":{"@id":"https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/"]}]},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/#primaryimage","url":"https:\/\/i0.wp.com\/miro.medium.com\/v2\/resize:fit:2000\/1*OdYWJV-jko9hiYBb9er6qQ.png?w=1600&resize=1600,765&ssl=1","contentUrl":"https:\/\/i0.wp.com\/miro.medium.com\/v2\/resize:fit:2000\/1*OdYWJV-jko9hiYBb9er6qQ.png?w=1600&resize=1600,765&ssl=1","width":"1600","height":"765","caption":"Tetragon ebpf"},{"@type":"BreadcrumbList","@id":"https:\/\/www.swreader.com\/index.php\/en\/2024\/06\/25\/build-and-debug-ebpf-project-tetragon\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.swreader.com\/"},{"@type":"ListItem","position":2,"name":"eBPF Tetragon Compilation and Debugging Guide"}]},{"@type":"WebSite","@id":"https:\/\/www.swreader.com\/#website","url":"https:\/\/www.swreader.com\/","name":"TianYa Blog","description":"Technology And Life","publisher":{"@id":"https:\/\/www.swreader.com\/#\/schema\/person\/9c90501e33afc9307d757bc8cfaf1c6f"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.swreader.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"zh-Hans"},{"@type":["Person","Organization"],"@id":"https:\/\/www.swreader.com\/#\/schema\/person\/9c90501e33afc9307d757bc8cfaf1c6f","name":"zdm","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/secure.gravatar.com\/avatar\/2670c9b6412a56381880b2ca03988f659e8a378fe7332238a4a741b660a60997?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2670c9b6412a56381880b2ca03988f659e8a378fe7332238a4a741b660a60997?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2670c9b6412a56381880b2ca03988f659e8a378fe7332238a4a741b660a60997?s=96&d=mm&r=g","caption":"zdm"},"logo":{"@id":"https:\/\/secure.gravatar.com\/avatar\/2670c9b6412a56381880b2ca03988f659e8a378fe7332238a4a741b660a60997?s=96&d=mm&r=g"},"sameAs":["http:\/\/www.swreader.com"],"url":"https:\/\/www.swreader.com\/index.php\/author\/zdm\/"}]}},"_links":{"self":[{"href":"https:\/\/www.swreader.com\/index.php\/wp-json\/wp\/v2\/posts\/293","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.swreader.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.swreader.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.swreader.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.swreader.com\/index.php\/wp-json\/wp\/v2\/comments?post=293"}],"version-history":[{"count":0,"href":"https:\/\/www.swreader.com\/index.php\/wp-json\/wp\/v2\/posts\/293\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.swreader.com\/index.php\/wp-json\/wp\/v2\/media\/295"}],"wp:attachment":[{"href":"https:\/\/www.swreader.com\/index.php\/wp-json\/wp\/v2\/media?parent=293"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.swreader.com\/index.php\/wp-json\/wp\/v2\/categories?post=293"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.swreader.com\/index.php\/wp-json\/wp\/v2\/tags?post=293"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}