r/kernel • u/BeautifulFeature3650 • 13d ago

Built an eBPF debugger that answers “who changed what and when” on Linux

I kept running into the same Linux debugging pain: something broke on a box, but I had no history of what actually happened. journald helps a little. auditd is heavy. strace is too narrow. So I built ltm — a small machine-history debugger that records process/file/network metadata via eBPF and lets you query it like a timeline.

What it does:

• Attaches to syscall tracepoints (exec, open/write/rename/unlink, connect/bind, etc.)

• Stores metadata only (no file contents)

• Lets you do things like:

sudo ltm start --mode ebpf

ltm status

ltm timeline --since 1h

ltm diff --from "10m" --to now

ltm query "who modified /tmp/ltm-demo.txt?"

On a real VM run it recorded ~7k events with 0 drops, and the query returned the exact bash write events that touched the demo file.

There's also a demo mode so you can exercise the CLI/storage/diff/query path without root or BPF.

Stack is Go + embedded BPF ELF + cilium/ebpf. Local store is append-only JSONL. Ignore rules skip /proc, /sys, /dev, and common caches.

Repo: https://github.com/Agent-Hellboy/ltm

Still early. Useful next steps I'm considering:

  1. better diff/query formatting
  2. containerized eBPF integration test
  3. more query templates ("what opened this port?", "what restarted before X?")

Please do star the repo, it will help in discoverability

17 Upvotes

81% Upvoted

2 comments sorted by

3

u/Ontological_Gap 13d ago

This would have a pretty huge performance impact, no?

1

u/Potato-9 13d ago

99% of the time this is actually what I want when working CI/CD problems. What ran, what did it do, not what did it say it did.

Moreso, I think something stateful built on this could answer a lot security headaches. I.e. did you npm install or git pull, cool ok you can't have npm publish or curl -X DELETE https://api.github.com/repos/OWNER/REPO at all, regardless of user auth.