All Projects → ingraind → Ingraind

ingraind / Ingraind

Licence: gpl-3.0
Data first monitoring agent using (e)BPF, built on RedBPF

Programming Languages

rust
11053 projects

Projects that are alternatives of or similar to Ingraind

Spm Agent Nodejs
NodeJS Monitoring Agent
Stars: ✭ 51 (-79.68%)
Mutual labels:  monitoring, agent
Inspectit Ocelot
inspectIT Ocelot - Java agent for collecting application performance, tracing and behavior data
Stars: ✭ 135 (-46.22%)
Mutual labels:  monitoring, agent
Dd Agent
Datadog Agent Version 5
Stars: ✭ 1,224 (+387.65%)
Mutual labels:  monitoring, agent
Huginn
Create agents that monitor and act on your behalf. Your agents are standing by!
Stars: ✭ 33,694 (+13323.9%)
Mutual labels:  monitoring, agent
Zorka
Sophisticated monitoring agent for Java
Stars: ✭ 178 (-29.08%)
Mutual labels:  monitoring, agent
Cilium
eBPF-based Networking, Security, and Observability
Stars: ✭ 10,256 (+3986.06%)
Mutual labels:  monitoring, ebpf
Tcpdog
eBPF based TCP observability.
Stars: ✭ 119 (-52.59%)
Mutual labels:  monitoring, ebpf
Inspectit
inspectIT is the leading Open Source APM (Application Performance Management) tool for analyzing your Java (EE) applications.
Stars: ✭ 513 (+104.38%)
Mutual labels:  monitoring, agent
Skydive
An open source real-time network topology and protocols analyzer
Stars: ✭ 2,086 (+731.08%)
Mutual labels:  monitoring, ebpf
Pinpoint
APM, (Application Performance Management) tool for large-scale distributed systems.
Stars: ✭ 11,883 (+4634.26%)
Mutual labels:  monitoring, agent
Spm Agent Mongodb
Sematext Agent for monitoring MongoDB
Stars: ✭ 7 (-97.21%)
Mutual labels:  monitoring, agent
Pinpoint C Agent
It is an agent written by C++, PHP, python languages. And we hope to support other languages by this agent. Until now, it supports [PHP],[C/C++] and [PYTHON].
Stars: ✭ 188 (-25.1%)
Mutual labels:  monitoring, agent
Stackimpact Java
StackImpact Java Profiler - Production-Grade Performance Profiler: CPU, locks, runtime metrics, and more
Stars: ✭ 7 (-97.21%)
Mutual labels:  monitoring, agent
Stackimpact Nodejs
DEPRECATED StackImpact Node.js Profiler - Production-Grade Performance Profiler: CPU, memory allocations, async calls, errors, metrics, and more
Stars: ✭ 46 (-81.67%)
Mutual labels:  monitoring, agent
Pixie
Instant Kubernetes-Native Application Observability
Stars: ✭ 589 (+134.66%)
Mutual labels:  monitoring, ebpf
Amon
Amon is a modern server monitoring platform.
Stars: ✭ 1,331 (+430.28%)
Mutual labels:  monitoring, agent
Stackimpact Go
DEPRECATED StackImpact Go Profiler - Production-Grade Performance Profiler: CPU, memory allocations, blocking calls, errors, metrics, and more
Stars: ✭ 276 (+9.96%)
Mutual labels:  monitoring, agent
Goappmonitor
Golang application performance data monitoring.
Stars: ✭ 478 (+90.44%)
Mutual labels:  monitoring, agent
Scouter
Scouter is an open source APM (Application Performance Management) tool.
Stars: ✭ 1,792 (+613.94%)
Mutual labels:  monitoring, agent
Myperf4j
High performance Java APM. Powered by ASM. Try it. Test it. If you feel its better, use it.
Stars: ✭ 2,281 (+808.76%)
Mutual labels:  monitoring, agent

ingraind

Data-first Monitoring

CircleCI CircleCI

ingraind is a security monitoring agent built around RedBPF for complex containerized environments and endpoints. The ingraind agent uses eBPF probes to provide safe and performant instrumentation for any Linux-based environment.

InGrain provides oversight of assets and risks:

  • Your customer data - an employee copying your customer database to their personal cloud store.
  • Your infrastructure - an attacker executing a zero day attack to gain access to your web servers.
  • Your resources - malware using your users machines compute resources to mine cryptocurrency.

This is what curl https://redsift.com looks like if seen through ingraind:

ingrain listening to DNS & TLS

Requirements

  • LLVM/Clang version 9 or newer
  • Rust toolchain rustup.rs
  • Linux 4.15 kernel or newer including kernel headers
  • capnproto

Compile

The usual Rust compilation ritual will produce a binary in target/release:

$ cargo build --release

or for a kernel version other than the running one:

$ export KERNEL_VERSION=1.2.3
$ cargo build --release

or with a custom kernel tree path (needs to include generated files):

$ export KERNEL_SOURCE=/build/linux
$ cargo build --release

We keep ingraind compatible with the musl target on x86_64, which you can build like so:

$ cargo build --release --target=x86_64-unknown-linux-musl

Build a docker image

To build a Docker image, use the instructions above to build an ingrain binary for the desired kernel. By default, the Dockerfile will assume you've built ingraind for the musl target.

$ docker build .

You can specify an arbitrary ingraind binary by setting the BINARY_PATH environment variable:

$ docker build --build-arg BINARY_PATH=./target/x86_64-unknown-linux-musl/release/ingraind .

Configuration & Run

To get an idea about the configuration file structure, consult the wiki or take a look at the example config for a full reference.

To start ingraind, run:

$ ./target/release/ingraind config.toml

Depending on the backends used in the config file, some secrets may need to be passed as environment variables. These are documented in config.toml.example, which should be a good starting point, and a sane default to get ingraind running, printing everything to the standard output.

Repo structure

The bpf directory contains the BPF programs written in C. These are compiled by build.rs, and embedded in the final binary, and will be managed by the grains.

The ingraind-probes directory contains the BPF programs written in Rust.

Anything else?

For more information, take a look at the Wiki

Code of Conduct

This project is for everyone. We ask that our users and contributors take a few minutes to review our code of conduct.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].