The AgentLoop Audit module supports two types of data ingestion: AI application ingestion (collecting Agent session logs) and AI Node ingestion (collecting runtime behavior through eBPF Runtime). This topic describes how to configure audit data ingestion in the Ingestion Center.
Ingestion methods
Ingestion method | Applicable scenario | Data storage | Description |
AI application ingestion | Hosts or container environments with AI Coding Agents deployed | agent-event / agent-event-webtracking | Collects Agent session logs including Session, Turn, and Tool Call behavior events. The specific write pipeline depends on the configuration generated by the Ingestion Center. |
AI Node Runtime/eBPF | Hosts or nodes that require runtime-level observability | ebpf-event Logstore | Collects LLM request characteristics, process behavior, file access, and network connections through eBPF |
Both ingestion methods can be used simultaneously. AI application ingestion provides complete session data at the Agent semantic level. AI Node Runtime/eBPF provides process-level runtime observability and can detect unmanaged Agent activities and unreported side effects.
Prerequisites
AgentLoop is activated and an AgentSpace is created.
AI Agent applications are deployed on the target hosts or clusters.
(AI application ingestion) The LoongSuite Pilot data collection component is deployed in the target environment.
(AI Node ingestion) The LoongCollector component with eBPF support is deployed in the target environment.
AI application ingestion
Supported Agent types
The Audit module currently supports session log ingestion for the following AI Coding Agents:
Agent type | Description |
Qoder | Qoder AI coding assistant |
Qoder CLI | Qoder command-line AI assistant |
Qoder Work | Qoder Work workspace assistant |
Cursor | Cursor AI coding assistant |
Claude Code | Claude Code AI coding assistant |
Codex | Codex AI coding assistant |
Ingestion steps
Log on to the AgentLoop console. In the left-side navigation pane, click Ingestion Center.
In the AI Observability area, find the target Agent type card (such as Qoder, Cursor, or Claude Code) and click it to enter the ingestion configuration.
Select the deployment scenario: Host, Kubernetes, or Docker.
Configure the ingestion parameters:
Parameter
Description
Application name prefix
Identifies a group of Agent instances and generates the service name, for example,
ai-coding-prodConnection method
Public network or Alibaba Cloud internal network
AgentSpace initialization
Initializes the current AgentSpace and binds the CMS Workspace and SLS Project
Project
The SLS Project bound to the current AgentSpace (read-only)
Log storage location
Application-side audit logs are written to agent-event / agent-event-webtracking. The specific destination depends on the collection configuration generated by the Ingestion Center.
Machine group
Select or create a machine group for the collection target
Configure data processing options:
Data masking (optional): Supports masking of sensitive information such as phone numbers, ID card numbers, email addresses, IP addresses, landline numbers, and bank card numbers. Data masking is disabled by default and can be enabled as needed.
Click Complete ingestion. The system automatically generates installation commands. Execute the installation commands on the target host or cluster to complete the Pilot deployment and collection configuration.
Ingestion verification
After ingestion is complete, check in the SLS console whether data is being written to agent-event / agent-event-webtracking. You can also view the latest data timestamp for the corresponding Agent application on the Audit Management page. Navigate to Audit Facts, filter by Agent type or application name, and verify that the reported Sessions, model request/response data, and tool call data are visible.
Collected data types
The audit logs collected through AI application ingestion include the following event types:
Event type | Description |
Session event | Creation and termination of Agent sessions |
Turn event | A single round of user-Agent interaction |
Step event | A single step executed by the Agent |
LLM request / response | LLM model requests and responses |
Tool call / tool result | Tool invocations and their return results |
Human approval checkpoint | Human approval checkpoints |
AI Node Runtime/eBPF ingestion
Overview
AI Node Runtime/eBPF ingestion uses eBPF technology to observe Agent runtime behavior at the kernel level without modifying application code. It can:
Identify AI Agent processes and their types running on hosts.
Capture LLM API request characteristics (model, tokens, and more).
Monitor process-level behaviors such as file reads/writes and network connections.
Detect Agent activities that are not registered through formal session log ingestion.
Ingestion steps
In the AI Observability area of the Ingestion Center, click the AI Node Runtime/eBPF card.
Select the deployment scenario: Host, Kubernetes, or Docker.
Configure the node scope parameters:
Parameter
Description
Project
The SLS Project bound to the current AgentSpace (read-only)
Logstore
Fixed to ebpf-event (read-only)
Machine group
Select or create a machine group for the collection target
Configure AgentSight detection rules:
Command-line allowlist: Define Agent process rules to include in collection. Each group contains an Agent type and a command-line argument pattern. Processes matching the allowlist are tagged with the corresponding Agent type.
Command-line blocklist: Define process patterns to exclude from collection. The blocklist takes precedence over the allowlist.
Domain allowlist: Define network access domain patterns to include in collection. Processes accessing allowlisted domains are also included in the collection scope.
When no configuration is provided, the system uses recommended defaults. After any item is configured, the current configuration fully overrides the corresponding default list.
Configure data masking options (optional). The same options as AI application ingestion are available.
Complete the ingestion configuration.
Ingestion verification
After eBPF ingestion is complete, check in the SLS console whether data is being written to the ebpf-event Logstore to confirm that ingestion is successful.
Data masking
Audit logs may contain sensitive information such as phone numbers, email addresses, and API keys. AgentLoop supports edge-side data masking during the data collection stage to prevent sensitive data from being stored in plaintext in log storage.
Supported masking types:
Phone numbers
ID card numbers
Email addresses
IP addresses
Landline numbers
Bank card numbers
Data masking is configured during ingestion setup, disabled by default, and enabled on demand. After masking is applied, the contextual information in the logs remains intact and readable, without affecting audit and troubleshooting capabilities.
Ingestion verification
After successful ingestion, verify using the following methods:
On the Audit Management page, check AI Application Audit and verify that the target application appears with a recent data timestamp.
On the Audit Facts page, filter by Agent type or application name and verify that you can see the reported Session data, Token statistics, and behavior analysis results.
For AI Node Runtime ingestion, check the AI Runtime Audit section on the Audit Management page and verify the number of collection hosts and the latest data timestamp.