gobpf

Prompt 1C: Create a Go package named dbpftrace with a README and docs, then create a cli utility named dbpftrace to: parse pid and descendents' fs syscall events (like bpftrace) using libbpfgo and godtrace Use either (cilium/ebpf or libbpfgo or gobpf) or (godtrace or (CGO or FFI) bindings to libdtrace) depending on which OS, by default cilium/ebpf: https://github.com/cilium/ebpf aquasecurity/libbpfgo https://github.com/aquasecurity/libbpfgo iovisor/gobpf w/ bcc: https://github.com/iovisor/gobpf chzyer/godtrace: https://github.com/chzyer/godtrace oracle/dtrace-utils/tree/devel/libdtrace: https://github.com/oracle/dtrace-utils/tree/devel/libdtrace From https://news.ycombinator.com/item?id=45755142 re eBPF for WAF: > awesome-ebpf > Kernel docs, examples, Go libraries: https://github.com/zoidyzoidzoid/awesome-ebpf#go-libraries : >> Go li

This [1] makes me think gobpf uses C bindings to bcc, so golang does not compile to eBPF, bcc does. [1] - https://github.com/iovisor/gobpf/tree/master/bcc

There are Go bindings for BPF and BCC: https://github.com/iovisor/gobpf I'm not sure the state of them at this point, but it's the same paradigm GP mentioned.