AI system runtime logs (eBPF) - AgentLoop - Alibaba Cloud Documentation Center

AI system runtime logs (eBPF) use eBPF to collect runtime behaviors of AI agents at the Linux kernel layer, including model interactions, processes, files, and network activities, without modifying agent application code. This topic describes how to configure AI system runtime logs (eBPF) in the integration center and verify that data is written correctly.

Scenarios

AI system runtime logs (eBPF) are applicable in the following scenarios:

Discover AI agents running on Linux hosts or in containers non-intrusively.
Collect runtime behaviors of agents, agent frameworks, and custom agents that are not integrated with LoongSuite Pilot or language and framework probes.
Correlate model interactions with processes, file access, command execution, and network activities.
Update the collection scope and AgentSight detection rules without restarting your workloads.

Supported scope

AI system runtime logs (eBPF) support Linux hosts, Docker, and Kubernetes scenarios that are available in the integration center. eBPF provides general coverage for common Linux runtimes. However, LLM payload collection may be limited when the target program uses a special TLS implementation or a runtime that is not currently supported.

eBPF may not directly obtain native Session, Turn, and Step identifiers or internal framework states. To obtain this context, use LoongSuite Pilot or language and framework probes in addition. For more information about how to select an integration method, see Select an AI Agent integration method.

Prerequisites

Before you begin, make sure that the following conditions are met:

AgentLoop is activated and an agent space is created.
The AI agents to collect are deployed on the target Linux hosts, containers, or clusters.
You have permissions to install or update LoongCollector, run integration commands, and manage machine groups.
The target environment meets the operating system, kernel, and network requirements displayed on the integration page.
For the Kubernetes DaemonSet scenario, the LoongCollector component in ACK is upgraded to 3.3.10 or later, and the eBPF Collection switch is enabled on the component configuration page.

Integration procedure

Log on to the AgentLoop. In the left-side navigation pane, click Integration Center.
In the AI Node Integration section, click AI System Runtime Logs.
Select a scenario based on the deployment environment of the agent, such as Linux host, Docker, or Kubernetes.

Configure the collection scope.

Parameter	Description
Project	The Simple Log Service (SLS) project bound to the current agent space. Read-only.
Logstore	The Logstore to which runtime logs are written. Fixed to `ebpf-event`. Read-only.
Machine group	Select or create the target machine group for collection.

Configure AgentSight detection rules. If you do not modify the configuration, the system uses the recommended default rules. After you modify any rule, the current configuration overrides the corresponding default rule. For details, see Configure AgentSight detection rules.
Enable data masking as needed. For details, see Data masking.
Follow the on-page instructions to install or update LoongCollector and the collection configuration in the target environment.

Configure AgentSight detection rules

Command line allowlist

The data collector can usually identify AI agents automatically and include them in the collection scope. If the target process is not identified, add rules to the command line allowlist. Each rule contains an agent type and a command line argument pattern. Processes that match a rule are tagged as the corresponding agent type.

Command line denylist

The command line denylist excludes process patterns that do not need to be collected. The denylist takes priority over the allowlist.

Domain allowlist

The domain allowlist determines which network activities enter the candidate collection scope. The default rules include common model service domains such as Model Studio, OpenAI, and Anthropic. When you use other model service providers or a custom AI gateway, add the corresponding domains.

Traffic that enters the candidate collection scope does not guarantee that its payload protocol can be parsed. If you can see network activities but cannot see complete model interactions, verify that the target protocol and runtime are within the currently supported scope.

Collect raw HTTPS traffic

After you enable Collect Https Raw Traffic, traffic that cannot be parsed into LLM semantics, such as unknown API paths or non-standard bodies, is no longer discarded. Instead, it is reported as raw HTTP.

Note

This feature is supported only in LoongCollector 3.3.10 or later.

Data masking

Runtime logs may contain sensitive information such as phone numbers, email addresses, and API keys. You can enable endpoint-side data masking in the integration configuration as needed. Supported data types include phone numbers, ID card numbers, email addresses, IP addresses, landline numbers, and bank card numbers.

Data masking is disabled by default. After you enable it, masked data still retains the necessary context for auditing and troubleshooting.

Verify the integration

After you complete the integration, check whether the ebpf-event Logstore in the SLS console contains the latest data from the target hosts or containers. If data is present in the Logstore, go to Audit management or Audit facts and verify that the target nodes, agents, or processes are queryable within the corresponding time range.

FAQ

No data in the Logstore

Verify that LoongCollector and the collection configuration are installed or updated successfully.
Verify that the target hosts or containers belong to the selected machine group.
Verify that the query time range covers the period after integration.
Verify that the target environment meets the operating system, kernel, and network requirements displayed on the page.

Target agent not identified

First, verify that the target process is running. If the data collector does not identify the process automatically, add the agent type and command line argument pattern to the command line allowlist.

Unwanted processes are collected

Add the process patterns to exclude to the command line denylist. The denylist takes priority over the allowlist.

Network activities visible but complete model interactions not available

Verify that the model service domain is in the domain allowlist, and that the protocol and runtime used by the target program are within the currently supported scope. The domain allowlist only changes the candidate collection scope and does not guarantee that the payload can be parsed. If you need to keep traffic that cannot be parsed, enable Collect Https Raw Traffic to have it reported as raw HTTP, which requires LoongCollector 3.3.10 or later.

AgentLoop:AI system runtime logs (eBPF)