Attribute EC2 Sensor Installation

Introduction

The Attribute EC2 sensor is an eBPF sensor installed as a systemd service on a Linux-based virtual machine.

It is designed to provide deep visibility and real-time monitoring of EC2 instances by leveraging eBPF (Extended Berkeley Packet Filter) technology. It captures detailed network and system-level events without requiring modifications to application code or kernel modules. The sensor operates as a passive observer, minimizing overhead and performance impact on the monitored system.

Requirements

Requirement	Details
Kernel version	5.10 or newer
Architecture	`x86_64` and `arm64`

Installation Guide

Replace <token> in the installation commands (see Appendix A) with the token provided by Attribute. Tokens are unique per account.
Execute the commands. They install and configure the systemd service for the sensor. The service will not start immediately after installation, but will run automatically on the next boot.
To start the service without rebooting, run:
```
sudo systemctl start zprobe
```

Appendix A: Installation Commands

Pull the Attribute installation script:

wget https://storage.googleapis.com/attrb-artifacts/standalone-install.sh

Make the script executable:
```
chmod +x ./standalone-install.sh
```
Run the script to install:
```
sudo ./standalone-install.sh <workload_name> 524288000 <token>
```
- Replace <workload_name> with the name of the service.
- 524288000 is the memory limit (500 MiB).
- Replace <token> with the token you received from Attribute. The token is unique per account.
Start the sensor:
```
sudo systemctl start zprobe
```
Check the sensor status:
```
sudo systemctl status zprobe
```
The status should be active (running). Example output:

Appendix B: Update Sensor Commands

To upgrade the sensor to a new version, re-run the install script — it will fetch the latest version. Use the same per-account token Attribute provided you.

Run the install script:
```
sudo ./standalone-install.sh <workload_name> 524288000 <token>
```
- Replace <workload_name> with the name of the service.
- 524288000 is the memory limit (500 MiB).
- Replace <token> with the token you received from Attribute. The token is unique per account.
Restart the sensor:
```
sudo systemctl restart zprobe
```

Trademarks: AWS is a trademark of Amazon.com, Inc. or its affiliates. All other trademarks are the property of their respective owners.

Introduction​

Requirements​

Installation Guide​

Appendix A: Installation Commands​

Appendix B: Update Sensor Commands​

Introduction

Requirements

Installation Guide

Appendix A: Installation Commands

Appendix B: Update Sensor Commands