Tracee

What Tracee is

Tracee is a free runtime security and observability tool for Linux that uses eBPF to monitor system calls, network activity, and file operations in real time. It generates events when it identifies behavior patterns that may point to suspicious activity or security threats. Event context can include process lineage, file paths, and network connections. Listed uses include security and compliance monitoring, troubleshooting, and forensic investigation. The project describes monitoring without code changes, low overhead, container awareness, and flexible policies. It can be deployed as an executable binary, a Docker Hub container image, or a Helm chart in Aqua Security’s registry; the quickstart covers Kubernetes installation with the Aqua Helm chart. Prometheus scraping is supported by default, with metrics at :3366/metrics. Tracee supports x86 and arm64 processors and requires Linux; documented long-term supported kernel versions are 5.4, 5.10, 5.15, 6.2, and 6.5, while some distribution kernels may also work. Instrumenting the kernel requires elevated capabilities, with privileged or root execution described as the easiest setup. Tracee does not run on macOS itself, though it can run inside a Linux VM and observe that VM rather than the Mac host.