Releases: elastic/quark
Releases · elastic/quark
v0.4
What's Changed
- Allow quark to be linked against system libraries by @haesbaert in #108
- Replace quark_queue_get_events(3) with get_event(). Fixes #107 by @haesbaert in #109
- Remove remaining cases of err(3). Issue #74 by @haesbaert in #111
- Pre net2 by @haesbaert in #115
- Make sure we always get tgid from exit by @haesbaert in #118
- Filter events out by ppid with -P in quark-mon(8) by @haesbaert in #119
- TCP socket events for EBPF by @haesbaert in #112
- Zap initial snapshots. Issue #113 by @haesbaert in #122
- Update ebpf to c8934b46470dbeb3488b4ade5f49314c0cab5cb3 by @haesbaert in #120
- Update libbpf to d4a841a32b04d69194ab5bdac359a51938a206ce by @haesbaert in #121
- Bring lo0 up on init and make sure to mount cgroups. by @haesbaert in #126
- Fix small new line whoops introduced in last commit by @haesbaert in #129
- Net infra by @haesbaert in #132
- Allow setting quark_verbose from the environment by @haesbaert in #133
- Sock tests by @haesbaert in #134
- Fix cap_inheritable test on newer kernels by @haesbaert in #137
- Update elastic/ebpf - new dns probes by @haesbaert in #138
- Catch fd leaks in all tests by @haesbaert in #142
- Sync elastic/ebpf to 8126a19945, fixes issue #135 by @haesbaert in #145
- Implement DNS events and general packet infrastructure by @haesbaert in #139
- Load fentry probes instead of kprobes when available. Issue #127 by @haesbaert in #146
- Bypass mode for ebpf, first steps by @haesbaert in #147
- Relocations by @haesbaert in #148
- Fedora tests (aka make the ci great again^W) by @haesbaert in #149
- RHEL CI Fiesta by @haesbaert in #151
- Fedora 42 is released, update CI by @haesbaert in #154
- Get rid of cdefs.h by @haesbaert in #156
- Build fixes for musl by @haesbaert in #159
- Add a build target for alpine, so we can ensure musl works by @haesbaert in #160
- Add file probes to bypass mode by @haesbaert in #158
- Generate README.md from quark.7. Issue #165 by @haesbaert in #166
- Remove paths size limitation, remove path copying, zap args_make, zap qstr by @haesbaert in #161
- Rename bpf_prog to bpf_probes. Issue #143 by @haesbaert in #168
- Add an option for not forking each test in quark-test. Issue #130 by @haesbaert in #169
- Load missing memfd probes for BYPASS. Issue #170 by @haesbaert in #172
- Make bpf compiler more configurable by @haesbaert in #173
- Make a few compat symbols weak by @nicholasberlin in #175
- Only attach the current number of active procs by @nicholasberlin in #176
- Ensure tracefs is always mounted by changing our access pattern. by @haesbaert in #180
- bpf_probes be mad by @haesbaert in #181
- Fix some missing qwarnx calls by @haesbaert in #182
- Make quark-test valgrind friendly by @haesbaert in #183
- Valgrind CI by @haesbaert in #184
- Load tty_write probe for BYPASS by @nicholasberlin in #186
- Fix recursive anon structures in btf. by @haesbaert in #187
- Cgroup by @haesbaert in #164
New Contributors
- @nicholasberlin made their first contribution in #175
Full Changelog: v0.3...v0.4
Contributors
haesbaert and nicholasberlin
Assets 2
v0.3
Notable changes:
- A new binary, quark-test(8) for testing the suite.
- An initramfs.gz target including init and infrastructure to run quark-test
statically built on any kernel via qemu. - Quark now knows about 4 namespaces (uts,ipc,mnt,net) and they're included in
quark_process{}. - Fixed pgid in RHEL8 since the enum value changes, also fixed upstream
elastic/ebpf.
What's Changed
- Humble beginnings of quark-test(8) by @haesbaert in #87
- Quark test goodies by @haesbaert in #88
- Run quark-test in the CI by @haesbaert in #89
- Add three more tests to quark-test(8) by @haesbaert in #90
- Small improvements to initramfs, init.c and logging by @haesbaert in #92
- Embed manpages into the binaries by @haesbaert in #93
- Fix pgid/sid for RHEL8 and improve kprobe expressions by @haesbaert in #91
- Probe data offsets are per probe, not per system. Fixes RHEL9. by @haesbaert in #94
- More const by @haesbaert in #95
- Sync elastic/ebpf to f8b0fc64816742f762a49cec697780890140db1c by @haesbaert in #96
- Improve output for tests by @haesbaert in #99
- Add kernel tests and improve testing infrastructure by @haesbaert in #100
- Cope with having no kernels to run in ktest-all by @haesbaert in #102
- Add namespace inode numbers to process events by @haesbaert in #103
- Increase proc_time_boot precision and make it immutable by @haesbaert in #104
- Fix a race in ktest-all and improve output by @haesbaert in #105
Full Changelog: v0.2...v0.3
Contributors
haesbaert
Assets 2
v0.2
Primarily a bug fix release due to 51e8137.
What's Changed
- Introduce build target initramfs.gz by @haesbaert in #83
- Stash the active backend in quark_queue_stats{} by @haesbaert in #84
- Fix a kprobe breakage introduced recently by @haesbaert in #85
Full Changelog: https://github.com/elastic/quark/commits/v0.2
Contributors
haesbaert
Assets 2
v0.1
5cae1f8
This commit was signed with the committer’s verified signature.
First release of quark, to be matched with go-quark.
A quick note on what this very first release includes:
- Kprobe & EBPF backends
- Process aggregation
- Event flow control
- Proper documentation
- 3940 compiled btfhub offsets
- quark-mon(8) and quark-btf(8)
- Go bindings
Many thanks to everyone involved, especially: @nicholasberlin, @mjwolf and
@fearful-symmetry.
And there was much rejoicing.
What's Changed
- Elftoolchain final by @haesbaert in #25
- Introduce quark_queue_attr{} by @haesbaert in #30
- Add TTY major, minor. Issue #32 by @haesbaert in #37
- Btfhub by @haesbaert in #42
- Compute entry leaders by @haesbaert in #40
- Add ebpf lost event counter. Issue #38 by @haesbaert in #48
- Fetch everything, everywhere, all at once. Issue #45 by @haesbaert in #47
- Go love + Snapshot by @haesbaert in #49
- Clean up go code, add go tests by @fearful-symmetry in #50
- Minor rewording for go docs by @haesbaert in #53
- Add license requirements by @haesbaert in #54
- Make love not cmake by @haesbaert in #56
- API for dumping the internal cache as a dot file. Issue #39 by @haesbaert in #57
- Docker builds and initial arm64 cross compilation by @haesbaert in #58
- Shut valgrind up on a false positive by @haesbaert in #59
- Refactor API and quark_event{} by @haesbaert in #60
- Rename build targets for consistency by @haesbaert in #61
- arm64 support, good times by @haesbaert in #62
- Github pages love by @haesbaert in #64
- Rework README.md and add extra sections in quark.7 by @haesbaert in #65
- Fix Go's Snapshot() by @haesbaert in #67
- Btfhub arm64 by @haesbaert in #66
- Centos7 build target by @haesbaert in #69
- Support older perf rings, needed for centos7 by @haesbaert in #70
- Plug memory leak by @haesbaert in #71
- Implement matching btfhub files with uname, makes centos7 work \o/ by @haesbaert in #72
- Logging functions, issue #2 by @haesbaert in #75
- Hook exit in kprobes on the same spot ebpf does. Fixes #68. by @haesbaert in #73
- Boot ci by @haesbaert in #76
- docs: Fix typo in index.html quickstart instructions by @palash25 in #78
- Humble beginnings of a CI pipeline by @haesbaert in #77
- Zap Go, moved to https://github.com/elastic/go-quark by @haesbaert in #80
- Add basic versioning scheme by @haesbaert in #79
New Contributors
- @fearful-symmetry made their first contribution in #50
- @palash25 made their first contribution in #78
Full Changelog: https://github.com/elastic/quark/commits/v0.1
Contributors
haesbaert, mjwolf, and 3 other contributors