TechPrufer
Get started
Datadog
Datadog logoDatadog · Feature trail

eBPF-based File Integrity Monitoring

2 posts · Nov 2025 – Jan 2026

What this trail covers

Datadog developed an eBPF-based File Integrity Monitoring (FIM) system to address the limitations of traditional methods like periodic scans, inotify, and auditd. The system ingests billions of file-related kernel events per minute and employs a multi-stage filtering approach. Initially, agent-side rules discard irrelevant events, reducing the volume to approximately one million events per minute. Further optimization involves moving significant event evaluation logic into eBPF programs to pre-filter 94% of events directly in the kernel, reducing the data volume sent to the backend and improving scalability and performance.

All Datadog trails
  1. Hardening eBPF for runtime security: Lessons from Datadog Workload Protection | DatadogThis post distills six lessons learned from operating Datadog's Workload Protection product, powered by eBPF, at scale. Key lessons include navigating kernel version and distribution compatibility challenges (program type, helper, map, hook point, inlining, verifier compatibility), capturing and enriching data correctly (e.g., handling event ordering, context propagation), monitoring and auditing eBPF usage (e.g., detecting malicious eBPF programs, understanding eBPF attack surface), operating alongside other eBPF users (e.g., avoiding conflicts, managing shared resources), measuring and controlling performance cost (e.g., understanding eBPF overhead, optimizing program logic), and shipping changes safely with strong rollout practices (e.g., phased rollouts, canary deployments). The post highlights specific pitfalls like silent hook failures, kernel version discrepancies, and performance regressions, and outlines engineering strategies to mitigate them.
  2. Scaling real-time file monitoring with eBPF: How we filtered billions of kernel events per minute | DatadogThis post details the evolution of Datadog's eBPF-based File Integrity Monitoring (FIM) system. It describes the challenge of handling over 10 billion file-related events per minute by introducing agent-side rules to filter events locally, reducing the volume to approximately one million events per minute. A key architectural shift involved moving significant event evaluation logic into eBPF programs to pre-filter 94% of events directly in the kernel, reducing data sent to the backend and improving scalability and performance.