Scaling real-time file monitoring with eBPF: How we filtered billions of kernel events per minute | Datadog

This post details the evolution of Datadog's eBPF-based File Integrity Monitoring (FIM) system. It describes the challenge of handling over 10 billion file-related events per minute by introducing agent-side rules to filter events locally, reducing the volume to approximately one million events per minute. A key architectural shift involved moving significant event evaluation logic into eBPF programs to pre-filter 94% of events directly in the kernel, reducing data sent to the backend and improving scalability and performance.