What is tracee?

Tracee is a runtime security and observability tool for Linux. It monitors what happens on a running system in real time, recording details about process activity, system calls, file access, and network connections. Based on these observations, it can also detect patterns that indicate suspicious behavior, such as a process attempting privileged actions it would not normally take, or a container behaving unexpectedly. The tool operates using eBPF, a feature built into the Linux kernel that allows programs to attach monitoring logic to kernel events without changing or replacing kernel code. This gives Tracee access to detailed, low-level system information while keeping performance impact low. Events can range from simple records of system activity to higher-level security signals assembled from multiple observations over time. Running Tracee on a single machine requires a single Docker command and works on most common Linux distributions. For organizations running containerized infrastructure, a Helm chart is available for deploying it across a Kubernetes cluster as a DaemonSet, which places an instance on every node in the cluster. Logs produced by Tracee flow through standard Kubernetes logging and can be routed to existing monitoring and alerting systems. Tracee is developed and maintained by Aqua Security, a company focused on securing containerized applications, and is released as open source under a permissive license. The project has documentation, contribution guidelines, and community channels through GitHub Discussions and Slack. It is written in Go. Users with compatibility questions or hardware-specific concerns can consult the prerequisites page in the project documentation.