Skip to content



This is an adapted version of opensnoop from bcc/libbpf-tools, you can check our source code here: examples/bpftools/opensnoop

You can just download the pre-compiled opensnoop package.json.

Or you can compile the opensnoop like this:

$ cd examples/bpftools/opensnoop
$ docker run -it -v /userpath/eunomia-bpf/examples/bpftools/opensnoop:/src`uname -m`:latest

userpath needs to be replaced with your own repo path.

After compile the eBPF code, you can define a config file like this:

  - name: opensnoop
        - name: eunomia_file_open_counter
          description: test
            - name: pid
            - name: comm
            - name: filename
              from: fname
    compiled_ebpf_filename: package.json

use the path to package.json as compiled_ebpf_filename in the config file. You can find the example at config.yaml.

Then, you can start the exporter:

$ ls
config.yaml  eunomia-exporter package.json
$ sudo ./eunomia-exporter

Running ebpf program opensnoop takes 46 ms
Listening on
running and waiting for the ebpf events from perf event...
Receiving request at path /metrics

Different from the bcc ebpf_exporter, the only thing you need to run on the deployment machine is the config file and package.json. There is no need to install LLVM/CLang for BCC.

The result is:


manage eBPF tracing program via API

start an eBPF exporter via web API:

$ curl -X POST -H "Content-Type: application/json" -d @examples/opensnoop/curl_post_example.json


see curl_post_example.json for the example of the request body.

list all running eBPF programs:

$ curl


stop an eBPF program:

$ curl -X POST -H "Content-Type: application/json" -d '{"id": 1}'


$ cargo build --release
$ target/release/eunomia-exporter -h
eunomia-exporter 0.1.0

    eunomia-exporter [OPTIONS]

    -c, --config <CONFIG>    Sets a custom config file [default: config.yaml]
    -h, --help               Print help information
    -V, --version            Print version information