I’m happy to announce the release of Fibratus 0.6.0. Let’s see what’s new in this version.
High performance kernel event stream collector
The kernel event stream collector has been rewritten from ground up. It now operates without GIL (Global Interpreter Lock) limitations which makes the Python interpreter capable of executing the byte code in parallel. The result is an ultra fast kernel event processing component!
The tricky part about releasing the GIL is that you can’t use any Python constructs before acquiring the GIL again. Such a simple operation as comparing strings has to be done by calling the function from the standard C library. Standard Python’s containers like
dict had been replaced with analogous C++
If you look at the source tree, you should notice the kstream directory has changed dramatically. This refactoring will make it easier adding new features to the kernel event stream collector.
Image meta information
Fibratus now supports querying the executable binary files for the PE (Portable Executable) headers. The
CreateProcess kernel events can be enriched with a plethora of interesting info like binary sections, the imported symbols, file information, linkage time stamp, etc. Here is the JSON representation of the image meta information for the
Multiple output sinks
The kernel events can now be streamed to multiple output sinks like message brokers, Elasticsearch instances and of course the standard output. In the previous version of Fibratus you had to rely on filaments to transport the event payloads to remote endpoints.
Beside this relevant features, there been done a ton of code refactoring and other improvements. For example, the bootstrap stage logs a lot of useful information, like the skips being applied, the outputs and its configuration, total boot time, etc.
If you have any feedback or would like to contribute you can reach out via Github or drop me an email.