Does Linux universal forwarder use kernel hook technology? Such as eBPF?

[xiyangyang]

Does Linux universal forwarder use kernel hook technology? Such as eBPF?

The forwarder version is  8.2.1.

[PickleRick]

And what is the problem you're trying to solve?

[livehybrid · Accepted solution]

Hi @xiyangyang 

No, the Linux UF does not use kernel hook technology like eBPF to monitor or collect data. It relies on reading log files, monitoring system logs, and other user-space data sources.

The Universal Forwarder primarily operates by:

• Monitoring files and directories (often using OS-level file system event notifications like inotify on Linux, or polling).
• Listening on specified network ports (TCP/UDP) for incoming data.
• Executing scripts and collecting their standard output.
• Reading from Windows event logs or other system-specific logging mechanisms.

Splunk does use eBPF in other product, but not in the UF. For more on eBPF see https://www.splunk.com/en_us/blog/learn/what-is-ebpf.html and for info on how its used in Splunk Infrastructure Monitoring (part of o11y suite) see https://www.splunk.com/en_us/products/infrastructure-monitoring-features.html

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[kiran_panchavat]

@xiyangyang 

The Splunk Universal Forwarder (UF) for Linux does not explicitly use eBPF or other kernel hook technologies as part of its core functionality for log collection and forwarding. The Universal Forwarder is designed to be a lightweight agent that collects logs and forwards them to a Splunk indexer or heavy forwarder.

While Splunk has shown interest in eBPF for observability in other contexts—such as contributing to OpenTelemetry and developing the Flowmill Collector—these advancements are not integrated into the Universal Forwarder. 

https://www.splunk.com/en_us/blog/learn/what-is-ebpf.html 

[isoutamo]

I cannot find confirmation now, but if I recall right linux is using inotify to get information in new events on log files with splunk?