TechPrufer
Sign inGet started

Blogs›Datadog›eBPF-based File Integrity Monitoring

eBPF-based File Integrity Monitoring

eBPF-based File Integrity Monitoring

2
posts
2025–2026

Datadog developed an eBPF-based File Integrity Monitoring (FIM) system to address the limitations of traditional methods like periodic scans, inotify, and auditd. The system ingests billions of file-related kernel events per minute and employs a multi-stage filtering approach. Initially, agent-side rules discard irrelevant events, reducing the volume to approximately one million events per minute. Further optimization involves moving significant event evaluation logic into eBPF programs to pre-filter events. This post details hardening eBPF for runtime security, focusing on lessons learned from Datadog Workload Protection. It covers challenges in program loading and kernel hook points across different kernel versions and distributions, including compatibility issues with program types, helpers, maps, hook point availability, function inlining, and verifier sensitivity. It also discusses capturing and enriching data correctly, monitoring and auditing eBPF usage, operating alongside other eBPF users, measuring and controlling performance cost, and safe rollout practices.

2026

Hardening eBPF for runtime security: Lessons from Datadog Workload Protection | Datadog

1/7/2026

This post details hardening eBPF for runtime security within Datadog Workload Protection. It elaborates on the challenges and lessons learned from running eBPF in production across diverse kernel versions and distributions. Key technical details include: navigating kernel version and distribution compatibility issues (program type, helper, map compatibility; hook point availability and naming; function inlining inconsistencies; eBPF verifier sensitivity and evolution), capturing and enriching data correctly, monitoring and auditing eBPF usage, operating alongside other eBPF users, measuring and controlling performance cost, and implementing safe rollout practices. It highlights specific pitfalls like program rejection on older kernels due to unsupported features, missing or renamed hook points, function inlining leading to blind spots, and verifier limitations on map usage and instruction counts.

2025

Scaling real-time file monitoring with eBPF: How we filtered billions of kernel events per minute | Datadog

11/18/2025

This post details the engineering challenges and solutions for scaling real-time file monitoring using eBPF. It highlights the overwhelming volume of kernel events (billions per minute) and the need for efficient filtering. The solution involves agent-side rules to reduce data to ~1 million events/minute and, crucially, moving significant evaluation logic into eBPF programs to pre-filter 94% of events directly in the kernel. This architectural shift reduces data transmission and processing load, enabling robust file integrity monitoring at scale.