Tools: Show Hn: Logira – Ebpf Runtime Auditing For AI Agent Runs 2026

OS-level runtime auditing for unpredictable automation.

OS-level runtime auditing for unpredictable automation.

logira is an observe-only Linux CLI that records runtime exec, file, and net events via eBPF. It helps you see what actually happened during AI agent runs and other forms of automation, with per-run local storage for auditing, post-run review, search, and detection triage.

logira includes an opinionated, observe-only default ruleset aimed at auditing AI agent runs. You can also append your own per-run rules YAML with logira run --rules .

To run the root daemon in the background, install the unit file from packaging/systemd/logirad.service.

Run an agent under audit as your normal user (events are auto-saved):

Default home directory: ~/.logira (override: LOGIRA_HOME)

eBPF programs under collector/linux/ are dual-licensed: Apache-2.0 OR GPL-2.0-only.

This ensures compatibility with the Linux kernel when loading eBPF programs that require GPL-only helpers.

OS-level runtime auditing for unpredictable automation.

Source: HackerNews