eBPF allows for some in-kernel logic, which can allow for filtering of data before it ever gets to userland. This can make it much faster than audit. eBPF is al

eBPF allows for some in-kernel logic, which can allow for filtering of data before it ever gets to userland. This can make it much faster than audit. eBPF is also much easier to extend with more complex logic since you can write near-arbitrary programs.