Skip to main content

eBPF Agent Overview

eBPF is a virtual machine running inside the Linux kernel that can execute safe, efficient, and programmable code in the kernel. eBPF stands for “Extended Berkeley Packet Filter.” It was originally designed for network packet filtering, but is now widely used in system tracing, security monitoring, performance analysis, and other fields.

The Tingyun eBPF Agent is integrated into the unified Agent. When the kernel performs certain operations (such as receiving network packets or system calls), the eBPF program is automatically invoked and can process these operations, calculating corresponding network metrics.

Note:

  • Currently, the eBPF Agent function only supports Kubernetes UniAgent and does not support the standard UniAgent.
  • The eBPF Agent is already installed on the Pod tingyun-linux-agent by default, but is not enabled.

Compatibility Requirements​

  • The eBPF Agent requires a Linux kernel version higher than 5.0, and the kernel must be compiled with eBPF-related options enabled.

  • Enabling the eBPF Agent requires at least 1GB of available memory and 500MB of disk space.

  • Before enabling the eBPF Agent, ensure your Node meets the following conditions:

    • The Node operating system must be Linux, and meet one of the following:

      • RedHat 8.0 or higher
      • CentOS 8 or higher
      • Debian 11 or higher
      • Ubuntu 18 or higher
      • Kylin V10 ARM64 or higher

    • Node available CPU: 1 core or above

    • Node available memory: 1GB or above

    • Node available storage: 1GB or above