A lightweight endpoint security and observability agent was engineered for Raspberry Pi 5 / ARM64 Linux. The system captures kernel-level process, file, network, and privilege telemetry through eBPF tracepoints, processes events via a C++17 user-space processor, writes rotating JSON logs, and applies reviewed process policies with protected safeguards.
Capture low-level Linux activity on resource-constrained ARM64 hardware without deploying a heavyweight monitoring stack. Convert noisy kernel events into structured telemetry with filtering, deduplication, rate limiting, and severity classification while protecting critical system processes.
02 / ENGINEERING
What OSYSTIC built
OSYSTIC delivered an eBPF-based security monitoring agent utilizing BPF ring buffers to transport kernel events to a C++17 user-space processor. The system filters noise, classifies runtime severity, generates rotating JSON telemetry, supports optional HTTP forwarding, and enforces policy controls with protected-process safeguards and audit trails.
Engineering Highlights
Kernel telemetry utilizing eBPF tracepoints for process execution/lifecycle, file/syscall activity, IPv4 connect activity, and privilege-change signals.
Efficient event transport from kernel space to the C++17 user-space processor via BPF ring buffers.
Noise control incorporating ignore lists, spam filtering, duplicate suppression, and per-process event rate limiting.
Structured runtime severity mapping directly into JSON telemetry.
Durable local evidence retention through rotating JSON Lines telemetry independent of remote receiver availability.
Safety guardrails including protected PIDs/processes and a dedicated enforcement audit trail.
Capabilities
Kernel Telemetry Collection
Event Filtering and Rate Limiting
Severity Classification
Rotating JSON Telemetry
Outbound HTTP Forwarding
Controlled Process Enforcement
Public Evidence Boundary
Client identity is confidential and omitted from this public showcase repository.
03 / DELIVERY
Outcomes and validation
Produced a maintainable Raspberry Pi 5 security-monitoring baseline combining kernel telemetry, structured user-space processing, local auditability, and controlled policy enforcement.
Passed automated GitHub Actions validation checks covering repository standards, secret history scans, and eBPF/C++ compilation builds.
Completed and accepted delivery baseline versioned as v1.0.0.
CLIENT PERSPECTIVEPROJECT-LINKED CLIENT FEEDBACK
“Quality of work high.”
Didier LuboC++ / Edge Systems · South Africa
Raspberry Pi 5 eBPF Security Monitoring Agent
Project-linked client feedback
Related engineering expertise
OSYSTIC / PROJECT CHANNELOPEN
START A PROJECT
Have a similar challenge?
Tell us what you need to build, the constraints, and where your team needs engineering support.