Logira is an eBPF-based runtime auditing tool for Linux that tracks what AI agents and automation actually do at the OS level. It records process execution, file activity, and network activity using cgroup v2 run-scoped tracking, attributing events to single audited runs.

Key Features

The tool provides per-run local storage in both JSONL and SQLite formats for timeline review and querying. It includes default detection rules focused on AI agent auditing, with optional custom YAML rules. Logira is observe-only by design—it records and detects but never blocks or enforces.

Default Detections

• Credential and secrets writes: ~/.ssh, ~/.aws, kube/gcloud/docker config, .netrc, .git-credentials, registry creds
• Sensitive credential reads: SSH private keys, AWS credentials/config, kubeconfig, docker config, .netrc, .git-credentials
• Persistence and config changes: writes under /etc, systemd units, cron, user autostart entries, shell startup files
• Temp droppers: executable files created under /tmp, /dev/shm, /var/tmp
• Suspicious exec patterns: curl|sh, wget|sh, tunneling/reverse shell tools and flags, base64 decode with shell hints
• Agent safety destructive patterns: rm -rf, git clean -fdx, find -delete, mkfs, terraform destroy, and similar commands
• Network egress: suspicious destination ports and cloud metadata endpoint access

Installation

Recommended installation via script:

curl -fsSL https://raw.githubusercontent.com/melonattacker/logira/main/install.sh | sudo bash

Or manual install from release tarball:

tar -xzf logira_vX.Y.Z_linux-<arch>.tar.gz
cd logira_vX.Y.Z_linux-<arch>
sudo ./install-local.sh

After installation or upgrade, restart the daemon:

sudo systemctl daemon-reload
sudo systemctl restart logirad.service
sudo systemctl status logirad.service --no-pager

How to Run

The root daemon logirad runs via systemd. Installation steps include:

# 1) Generate eBPF objects (only needed if missing)
make generate

2) Install the systemd unit
sudo install -D -m 0644 packaging/systemd/logirad.service /etc/systemd/system/logirad.service
3) Install the daemon binary (unit defaults to /usr/local/bin/logirad)
sudo install -m 0755 ./logirad /usr/local/bin/logirad
4) (Recommended) Point systemd at the eBPF .o files via an environment file
sudo mkdir -p /etc/logira
sudo tee /etc/logira/logirad.env > /dev/null << 'EOF'
LOGIRA_EXEC_BPF_OBJ=/absolute/path/to/collector/linux

Custom rules can be appended per-run with logira run --rules <file>.