Add event-driven memory syscall telemetry

enodia_sentinel/daemon.py

@@ -24,10 +24,11 @@ class Sentinel:
         self.cfg = cfg
         self.start_time = time.time()
         self.cooldowns: dict[str, float] = {}
-        # Cooldowns are touched by both the sweep loop and the eBPF event
-        # thread, so guard them.
+        # Cooldowns are touched by the sweep loop and eBPF event threads, so
+        # guard them.
         self._cooldown_lock = threading.Lock()
         self._exec_monitor = None
+        self._syscall_monitor = None
         self.last_persist_scan = self.start_time
         self.listener_baseline: set[str] = set()
         self.suid_baseline: set[str] = set()
@@ -236,7 +237,7 @@ class Sentinel:
         return out
 
     def _on_exec_alert(self, alert: Alert) -> None:
-        """Callback for the eBPF exec monitor — same dedup + capture path."""
+        """Callback for eBPF monitors — same dedup + capture path."""
         fresh = self.fresh_alerts([alert], time.time())
         if fresh:
             threading.Thread(
@@ -256,6 +257,7 @@ class Sentinel:
         self.load_fim_baseline()
         snapshot.prune(self.cfg)
         self._start_exec_monitor()
+        self._start_syscall_monitor()
         sweeps = 0
         while not self._stop.is_set():
             now = time.time()
@@ -297,6 +299,21 @@ class Sentinel:
         if not ok:
             self._exec_monitor = None
 
+    def _start_syscall_monitor(self) -> None:
+        if not self.cfg.ebpf_syscall_monitor:
+            with open(self.cfg.events_log, "a") as fh:
+                fh.write(f"{time.strftime('%FT%T%z')} "
+                         "eBPF syscall monitor: off (disabled in config)\n")
+            return
+        from .events.monitor import SyscallMonitor
+        self._syscall_monitor = SyscallMonitor(self.cfg, self._on_exec_alert)
+        ok, reason = self._syscall_monitor.start()
+        with open(self.cfg.events_log, "a") as fh:
+            status = "enabled" if ok else f"disabled ({reason})"
+            fh.write(f"{time.strftime('%FT%T%z')} eBPF syscall monitor: {status}\n")
+        if not ok:
+            self._syscall_monitor = None
+
     def _capture(self, alerts: list[Alert]) -> None:
         try:
             snapshot.capture(alerts, SystemState(), self.cfg)
@@ -308,3 +325,5 @@ class Sentinel:
         self._stop.set()
         if self._exec_monitor is not None:
             self._exec_monitor.stop()
+        if self._syscall_monitor is not None:
+            self._syscall_monitor.stop()