---
title: "Use eBPF as the default telemetry source"
slug: "use-ebpf-as-the-default-telemetry-source"
updated: 2024-03-22T19:33:57Z
published: 2024-03-22T19:33:57Z
canonical: "docs.redcanary.com/use-ebpf-as-the-default-telemetry-source"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Use eBPF as the Default Telemetry Source

You can configure your endpoints to collect telemetry using eBPF instead of AuditD.

## Overview

Before making any changes to your sensors, check the [system and network requirements](/doc/docs/system-and-network-requirements-for-linux-edr) to determine whether eBPF data collection is supported for your endpoints.

## Enable eBPF

1. Update the sensor configuration file.
2. Optionally disable the DebugFS automount feature.
3. Restart the sensor.

## Update the sensor configuration file

1. Go to `/opt/redcanary/`.
2. Open `config.json`, and add the following lines:

```plaintext
"telemetry": {
    "source": "ebpf"
}
```
3. Save the file.

> **Note:** If the eBPF initialization fails, the sensor defaults to using AuditD. If you’d prefer the sensor to turn off by default, add `“restricted": true` to the `"telemetry"` object.

## Optional: Disable DebugFS automount

In order to collect telemetry using eBPF, your endpoint must be able to access the debug file system, also known as DebugFS. DebugFS is mounted by default on most Linux systems. If DebugFS isn’t already mounted, the sensor will try to mount it for you. You can disable the automount feature by adding `"automount": false` to the `"telemetry"` object.

## Restart the sensor

Your configuration changes won’t take effect until you restart the sensor. For instructions on restarting the Linux EDR sensor service, see [performance debugging.](/doc/docs/performance-debugging)