/usr/bin/tetragon

Tetragon - eBPF-based Security Observability and Runtime Enforcement

Usage:
  tetragon [flags]

Flags:
      --bpf-debug-area sliceString                Enable BPF tracing messages for specified areas (all, generic, process, uprobe_so)
      --bpf-debug-log                             Enable forwarding BPF trace messages to tetragon log as info messages
      --bpf-dir string                            Set tetragon bpf directory (default 'tetragon') (default "tetragon")
      --bpf-lib string                            Location of Tetragon libs (btf and bpf files) (default "/var/lib/tetragon/")
      --btf string                                Location of btf
      --cgroup-rate string                        Base sensor events cgroup rate <events,interval> disabled by default ('1000,1s' means rate 1000 events per second)
      --cluster-name string                       Name of the cluster where Tetragon is installed
      --config-dir string                         Configuration directory that contains a file for each option
      --cri-endpoint string                       CRI endpoint
      --data-cache-size int                       Size of the data events cache (default 1024)
  -d, --debug                                     Enable debug messages. Equivalent to '--log-level=debug'
      --deleted-pod-cache-size int                Size of the deleted pod cache (default 1024)
      --disable-kprobe-multi                      Allow to disable kprobe multi interface
      --disable-process-cache                     Disable process cache
      --enable-ancestors sliceString              Comma-separated list of process event types to enable ancestors for (base, kprobe, tracepoint, loader, uprobe, lsm, usdt). Unknown event types will be ignored. Type 'base' enables ancestors for process_exec and process_exit events and is required by all other supported event types for correct reference counting.
      --enable-cgidmap                            enable pod resolution via cgroup ids
      --enable-cgidmap-debug                      enable cgidmap debugging info
      --enable-cgtrackerid                        enable cgroup tracker id (only used if 'enable-cgidmap' is set) (default true)
      --enable-cri                                enable CRI client for tetragon
      --enable-deprecated-tracingpolicy-grpc      Enable deprecated gRPC TracingPolicy APIs
      --enable-event-metrics                      Enable per-event metrics. Enabled by default. Health and resource metrics are always available when --metrics-server is set. (default true)
      --enable-export-aggregation                 Enable JSON export aggregation
      --enable-k8s-api                            Access Kubernetes API to associate Tetragon events with Kubernetes pods
      --enable-msg-handling-latency               Enable metrics for message handling latency
      --enable-pid-set-filter                     Enable pidSet export filters. Not recommended for production use
      --enable-pod-annotations                    Add pod annotations field to events.
      --enable-pod-info                           Enable PodInfo custom resource
      --enable-policy-filter                      Enable policy filter code
      --enable-policy-filter-cgroup-map           Enable cgroup mappings for policy filter maps
      --enable-policy-filter-debug                Enable policy filter debug messages
      --enable-process-cred                       Enable process_cred events
      --enable-process-environment-variables      Include environment variables in process_exec events. Disabled by default. Note that this option can significantly increase the size of the events and may impact performance, as well as capture sensitive information such as passwords in the events (you can use --redaction-filters to redact the data).
      --enable-process-ns                         Enable namespace information in process_exec and process_kprobe events
      --enable-tracing-policy-crd                 Enable TracingPolicy and TracingPolicyNamespaced custom resources (default true)
      --event-cache-retries int                   Number of retries for event cache (default 15)
      --event-cache-retry-delay int               Delay in seconds between event cache retries (default 2)
      --event-queue-size uint                     Set the size of the internal event queue. (default 10000)
      --execve-map-entries int                    Set entries for execve_map table (default 32768)
      --execve-map-no-prealloc                    Do not preallocate the entries of execve_map
      --execve-map-size string                    Set size for execve_map table (allows K/M/G suffix)
      --export-aggregation-buffer-size uint       Aggregator channel buffer size (default 10000)
      --export-aggregation-window-size duration   JSON export aggregation time window (default 15s)
      --export-allowlist string                   JSON export allowlist
      --export-denylist string                    JSON export denylist
      --export-file-compress                      Compress rotated JSON export files
      --export-file-max-backups int               Number of rotated JSON export files to retain (default 5)
      --export-file-max-size-mb int               Size in MB for rotating JSON export files (default 10)
      --export-file-perm string                   Access permissions on JSON export files (default "600")
      --export-file-rotation-interval duration    Interval at which to rotate JSON export files in addition to rotating them by size
      --export-filename string                    Filename for JSON export. Disabled by default
      --export-rate-limit int                     Rate limit (per minute) for event export. Set to -1 to disable rate limiting, 0 to disable JSON export, or a positive integer to rate limit event export (default -1)
      --expose-stack-addresses                    Expose real linear addresses in events stack traces
      --fentry-heap-size int                      Set the maximum number of entries in the process call heap map used by fentry/fexit sensors (default 32768)
      --field-filters string                      Field filters for event exports
      --filter-environment-variables strings      Filter for specific environment variables
      --force-large-progs                         Force loading large programs, even in kernels with < 5.3 versions
      --force-small-progs                         Force loading small programs, even in kernels with >= 5.3 versions
      --generate-docs                             Generate documentation in YAML format to stdout
      --gops-address string                       gops server address (e.g. 'localhost:8118'). Disabled by default
      --health-server-address string              Health server address (e.g. ':6789')(use '' to disabled it) (default ":6789")
      --health-server-interval int                Health server interval in seconds (default 10)
  -h, --help                                      help for tetragon
      --k8s-controlplane-retry int                Number of attempts for Kubernetes control plane connection (negative for infinite, zero is invalid, positive for max attempts) (default 1)
      --k8s-kubeconfig-path string                Absolute path of the kubernetes kubeconfig file
      --keep-sensors-on-exit                      Do not unload sensors on exit
      --kernel string                             Kernel version
      --log-file string                           Set log file where tetragon agent logs will be written (in addition to stdout or stderr)
      --log-format string                         Set log format (default "text")
      --log-level string                          Set log level (default "info")
      --lsm-heap-size int                         Set the maximum number of entries in the process call heap map used by lsm sensors (default 32768)
      --metrics-label-filter string               Comma-separated list of enabled metrics labels. Unknown labels will be ignored. (default "namespace,workload,pod,binary")
      --metrics-server string                     Metrics server address (e.g. ':2112'). Disabled by default
      --netns-dir string                          Network namespace dir (default "/var/run/docker/netns/")
      --parents-map-enabled                       Enable parents_map for matchParentBinaries selector
      --parents-map-entries int                   Set entries for parents_map table (default 32768)
      --parents-map-size string                   Set size for parents_map table (allows K/M/G suffix)
      --persist-grpc-policies                     Persist tracing policies installed over gRPC across agent restarts
      --persist-grpc-policies-dir string          Directory in which to persist tracing policies installed over gRPC (default "/var/run/tetragon/grpc-policies")
      --pprof-address string                      Serves runtime profile data via HTTP (e.g. 'localhost:6060'). Disabled by default
      --process-cache-gc-interval duration        Time between checking the process cache for old entries (default 30s)
      --process-cache-size int                    Size of the process cache (default 65536)
      --procfs string                             Location of procfs to consume existing PIDs (default "/proc/")
      --rb-queue-size string                      Set size of channel between ring buffer and sensor go routines (default 65k, allows K/M/G suffix) (default "65535")
      --rb-size string                            Set ring buffer size for single cpu (default 65k, allows K/M/G suffix) (default "0")
      --rb-size-total string                      Set ring buffer size in total for all cpus (default 65k per cpu, allows K/M/G suffix) (default "0")
      --redaction-filters string                  Redaction filters for events
      --release-pinned-bpf                        Release all pinned BPF programs and maps in Tetragon BPF directory. Enabled by default. Set to false to disable (default true)
      --retprobes-cache-size int                  Set {k,u}retprobes events cache maximum size (default 4096)
      --server-address string                     gRPC server address (e.g. 'localhost:54321' or 'unix:///var/run/tetragon/tetragon.sock'). An empty address disables the gRPC server. WARNING: Exposing gRPC on a TCP socket without TLS client verification exposes Tetragon to unprivileged users on the host or with network access. (default "localhost:54321")
      --server-tls-cert-file string               Path to a PEM-encoded server certificate. When set, TLS is enabled on the TCP gRPC listener.
      --server-tls-client-ca-files strings        Paths to PEM-encoded CA bundles used to verify client certificates. Required when --server-tls-require-client-cert is true.
      --server-tls-key-file string                Path to the PEM-encoded private key matching --server-tls-cert-file. Required when --server-tls-cert-file is set.
      --server-tls-require-client-cert            Require and verify client certificates (mTLS). Requires --server-tls-client-ca-files.
      --sleepable-offload-size int                Set the maximum number of entries in the sleepable offload map (default 32768)
      --sleepable-preload-size int                Set the maximum number of entries in the sleepable preload map (default 32768)
      --tracing-policy string                     Tracing policy file to load at startup
      --tracing-policy-dir string                 Directory from where to load Tracing Policies (default "/etc/tetragon/tetragon.tp.d")
      --uprobe-heap-size int                      Set the maximum number of entries in the process call heap map used by uprobe/usdt sensors (default 32768)
      --use-perf-ring-buffer                      Use the perf ring buffer instead of the bpf ring buffer
      --username-metadata string                  Resolve UIDs to user names for processes running in host namespace (default "disabled")
      --verifier-log-level int                    set eBPF verifier log level. Pass 0 for silent, 1 for truncated logs, 2 for a full dump