Nudgebee Node Agent

A per-node observability agent for Kubernetes and Linux hosts. The agent gathers container and host metrics, logs, and L7 traffic using eBPF and exposes them in Prometheus format.

Minimum Linux kernel: 5.1 (eBPF CO-RE).

This project is a fork of coroot/coroot-node-agent with additional features developed at Nudgebee. See NOTICE for attribution and CHANGELOG.md for the list of divergences from upstream.

Features

Inherited from upstream

• TCP connection tracing — service map and inter-service latency, derived from eBPF connect() / accept() / retransmit / RTT events.
• Log pattern extraction — clusters container logs into recurring patterns at the node, drastically reducing log volume for analysis. Reads from /var/log/, journald, dockerd, and containerd CRI logs.
• Delay accounting — per-container CPU and disk-wait metrics from the kernel's delay accounting subsystem via Netlink.
• OOM-kill events — surfaces container_oom_kills_total.
• Cloud instance metadata — auto-detects AWS, GCP, Azure, Hetzner, IBM Cloud, and Oracle Cloud and tags metrics with account ID, instance type, region, AZ, lifecycle (spot/on-demand), and addresses.
• GPU monitoring (NVIDIA via NVML), JVM metrics (via JMX/jattach), .NET and Node.js process detection.

Added in this fork

• LLM observability — detects calls to OpenAI, Anthropic, AWS Bedrock, Google AI / Vertex, Azure OpenAI, Cohere, and OpenAI-compatible endpoints from eBPF-traced TLS sessions, and emits per-request metrics including model name, token counts, latency, time-to-first-token, and estimated cost.
• IP-to-FQDN resolver — enriches outbound flows with hostnames and K8s workload identity by combining Service/Pod/Node informers with the DNS cache, so the service map shows payments-api instead of 10.0.5.41.
• Enhanced L7 protocol detection — TLS SNI extraction, lightweight HTTP/2 parsing with HPACK, improved Go TLS capture, Node.js TLS, FoundationDB.
• PSI cgroup metrics — pressure-stall info for CPU, memory, and IO.
• Stability fixes — graceful shutdown, bounded caches, label cardinality controls, panic guards in L7 parsers, OOM mitigations.

Installation

Kubernetes (DaemonSet)

kubectl apply -f https://raw.githubusercontent.com/nudgebee/node-agent/main/manifests/nudgebee-node-agent.yaml

This creates the nudgebee namespace and a privileged DaemonSet that exposes /metrics on port 80.

systemd (bare-metal)

curl -fsSL https://raw.githubusercontent.com/nudgebee/node-agent/main/install.sh | sudo sh -

Pass -v vX.Y.Z to pin to a specific release. The script writes a systemd unit at /etc/systemd/system/nudgebee-node-agent.service and starts it.

Kubernetes is not required. With no Kubernetes API available, the agent names connections by systemd unit, container, host and DNS name instead of by pod and service; see standalone hosts.

Container image

Multi-arch images (linux/amd64, linux/arm64) are published to GHCR on every tag:

ghcr.io/nudgebee/node-agent:<version>
ghcr.io/nudgebee/node-agent:<major>.<minor>
ghcr.io/nudgebee/node-agent:<major>

Metrics

The agent exposes Prometheus metrics on :80/metrics. Self-identifying label: job="nudgebee-node-agent".

• Nudgebee-specific metrics:
  • LLM observability
  • IP-to-FQDN resolver
• The full inherited metric catalogue is documented upstream at docs.coroot.com/metrics/node-agent.

Contributing

See CONTRIBUTING.md. Bug reports and pull requests are welcome.

Security

Please report vulnerabilities privately per SECURITY.md.

License

This project is licensed under the Apache License, Version 2.0.

The eBPF C code in ebpftracer/ebpf/ is licensed under the GNU General Public License, Version 2.0; see LICENSES/GPL-2.0.txt.

See NOTICE for attribution to the original coroot/coroot-node-agent project.