rlg-ebpf 0.0.11

Kernel-context enrichment for rlg records. Attaches PID, TID, UID, and (future) network 4-tuple to every log record. Optional eBPF kernel-side attach programs land in Phase 21.1.
docs.rs failed to build rlg-ebpf-0.0.11
Please check the build logs for more information.
See Builds for ideas on how to fix a failed build, or Metadata for how to configure docs.rs builds.
If you believe this is docs.rs' fault, open an issue.

Install

[dependencies]
rlg-ebpf = "0.0.11"

Requires Rust 1.88.0 or newer (edition 2024).

Usage

use rlg::log::Log;
use rlg_ebpf::{Enricher, ProcessEnricher};

let enricher = ProcessEnricher::new();
let log = Log::info("checkout completed");
let enriched = enricher.enrich(log);

// enriched.attributes now contains "pid", plus "tid" and "uid"
// on Unix targets.

Chain multiple enrichers with Chain:

use rlg_ebpf::{Chain, Enricher, ProcessEnricher};

struct AddService;
impl Enricher for AddService { /* … attach service name … */ }

let pipeline = Chain::new(ProcessEnricher::new(), AddService);

Enrichers

Enricher Fields attached Platform Feature
ProcessEnricher pid, tid (Unix), uid (Unix) Portable (default)
EbpfEnricher delegates to ProcessEnricher (Phase 21.1: adds cgroup, caps, network 4-tuple) Linux ebpf
Chain<A, B> union of the two enrichers, applied left-to-right Portable (default)

EbpfEnricher status: scaffold

The ebpf feature enables an EbpfEnricher type whose live kernel-side program attach lands in Phase 21.1. Today the type delegates to ProcessEnricher for correctness — future consumers of the type get the extra kernel context transparently once Phase 21.1 lands. See docs/adr/0012-ebpf-enricher.md.

Capability requirements

Attaching the future eBPF program will require either CAP_BPF (Linux 5.8+) or CAP_SYS_ADMIN (older kernels). The current ProcessEnricher has no capability requirements — pid/tid/uid are readable from any process.

License

Dual-licensed under Apache 2.0 or MIT, at your option.