--- title: BPF to transform SSH Sessions to Structured Event description: Teleport 4.2's Enhanced Session Recording feature uses eBPF programs (execsnoop, opensnoop, tcpconnect) to transform unstructured SSH session recordings into... canonical: https://daily.dev/posts/bpf-to-transform-ssh-sessions-to-structured-event-ivtx3dabc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: BPF to transform SSH Sessions to Structured Event | daily.dev og:description: Teleport 4.2's Enhanced Session Recording feature uses eBPF programs (execsnoop, opensnoop, tcpconnect) to transform unstructured SSH session recordings into... og:url: https://daily.dev/posts/bpf-to-transform-ssh-sessions-to-structured-event-ivtx3dabc og:image: https://api.daily.dev/og/posts/IvTx3DaBc.png og:image:alt: BPF to transform SSH Sessions to Structured Event og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # BPF to transform SSH Sessions to Structured Event **[Teleport](https://daily.dev/sources/teleport)** · 10 min read · 0 upvotes · 0 comments ## Summary Teleport 4.2's Enhanced Session Recording feature uses eBPF programs (execsnoop, opensnoop, tcpconnect) to transform unstructured SSH session recordings into structured events, closing audit gaps caused by obfuscation, shell scripts, and terminal echo tricks. The team evaluated regex parsing, Linux Audit, inotify, and fanotify before settling on BPF for its low false-positive rate and minimal performance overhead. Cgroups (cgroupv2) are used to correlate program execution with a specific SSH session and identity. The feature requires Linux Kernel 4.18+ with BPF support, kernel headers, and bcc-tools, and works best for non-root users since root can bypass it. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are the minimum requirements to run Teleport Enhanced Session Recording? Teleport Enhanced Session Recording requires Linux Kernel 4.18 or newer with BPF support enabled, plus kernel headers and bcc-tools installed. Ubuntu 19.04, Debian 10, and RHEL/CentOS 8 support this out of the box. Enable it by setting enhanced_recording enabled to yes under ssh_service in the Teleport configuration file. _daily.dev surfaces practical rollout notes like this for teams hardening SSH audit pipelines._ ### Why did Teleport choose eBPF over fanotify or Linux Audit for SSH session monitoring? eBPF was chosen because Linux Audit was ruled out for performance reasons, and fanotify had two drawbacks: in Brendan Gregg's tests, fanotify used 1% CPU under heavy load versus 67% for the ad-hoc opensnoop tool, but fanotify's whole-filesystem-monitoring improvements only merged into Linux 5.1, unavailable in mainstream distros at the time. BPF met the goals of near-zero false positives and near-zero performance impact. _Compare monitoring approach trade-offs like these before picking a security tool on daily.dev._ ### How does Teleport correlate BPF-captured events with a specific SSH session? Teleport uses cgroups, specifically cgroupv2, to tie program execution to a session. When an SSH session starts, Teleport re-launches itself inside a dedicated cgroup so every subsequent process it spawns carries a unique cgroup ID; the BPF programs (execsnoop, opensnoop, tcpconnect) were updated to emit that cgroup ID with each event, linking execution and network activity back to the session and user identity. _Track implementation details like these on daily.dev when building session auditing into infrastructure._ ## Similar posts on daily.dev - [12 eBPF-Powered CLI Utilities That Every Modern Linux Sysadmin Should Master](https://daily.dev/posts/12-ebpf-powered-cli-utilities-that-every-modern-linux-sysadmin-should-master-xhmtccbiq) · It's Foss · 1 upvotes · 0 comments - [What Is eBPF? Use Cases, Benefits, and Key Differences](https://daily.dev/posts/what-is-ebpf-use-cases-benefits-and-key-differences-5dgqadloo) · Isovalent · 3 upvotes · 0 comments - [Cloudflare’s eBPF Replatforming Part 2: Filling Gaps in the Linux Ecosystem with eBPF](https://daily.dev/posts/cloudflare-s-ebpf-replatforming-part-2-filling-gaps-in-the-linux-ecosystem-with-ebpf-f9wl5aqgf) · eBPF · 3 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/bpf-to-transform-ssh-sessions-to-structured-event-ivtx3dabc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"BPF to transform SSH Sessions to Structured Event","url":"https://daily.dev/posts/bpf-to-transform-ssh-sessions-to-structured-event-ivtx3dabc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/bpf-to-transform-ssh-sessions-to-structured-event-ivtx3dabc"},"datePublished":"2026-08-23T12:22:01.004Z","dateModified":"2026-08-23T12:49:21.935Z","description":"Teleport 4.2's Enhanced Session Recording feature uses eBPF programs (execsnoop, opensnoop, tcpconnect) to transform unstructured SSH session recordings into...","image":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","thumbnailUrl":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/bpf-to-transform-ssh-sessions-to-structured-event-ivtx3dabc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux,ssh","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"BPF to transform SSH Sessions to Structured Event"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/bpf-to-transform-ssh-sessions-to-structured-event-ivtx3dabc#faq","mainEntity":[{"@type":"Question","name":"What are the minimum requirements to run Teleport Enhanced Session Recording?","acceptedAnswer":{"@type":"Answer","text":"Teleport Enhanced Session Recording requires Linux Kernel 4.18 or newer with BPF support enabled, plus kernel headers and bcc-tools installed. Ubuntu 19.04, Debian 10, and RHEL/CentOS 8 support this out of the box. Enable it by setting enhanced_recording enabled to yes under ssh_service in the Teleport configuration file. daily.dev surfaces practical rollout notes like this for teams hardening SSH audit pipelines."}},{"@type":"Question","name":"Why did Teleport choose eBPF over fanotify or Linux Audit for SSH session monitoring?","acceptedAnswer":{"@type":"Answer","text":"eBPF was chosen because Linux Audit was ruled out for performance reasons, and fanotify had two drawbacks: in Brendan Gregg's tests, fanotify used 1% CPU under heavy load versus 67% for the ad-hoc opensnoop tool, but fanotify's whole-filesystem-monitoring improvements only merged into Linux 5.1, unavailable in mainstream distros at the time. BPF met the goals of near-zero false positives and near-zero performance impact. Compare monitoring approach trade-offs like these before picking a security tool on daily.dev."}},{"@type":"Question","name":"How does Teleport correlate BPF-captured events with a specific SSH session?","acceptedAnswer":{"@type":"Answer","text":"Teleport uses cgroups, specifically cgroupv2, to tie program execution to a session. When an SSH session starts, Teleport re-launches itself inside a dedicated cgroup so every subsequent process it spawns carries a unique cgroup ID; the BPF programs (execsnoop, opensnoop, tcpconnect) were updated to emit that cgroup ID with each event, linking execution and network activity back to the session and user identity. Track implementation details like these on daily.dev when building session auditing into infrastructure."}}]} ```