Crate rlg_ebpf 

Kernel-context enrichment for rlg records.

Attaches process-level context (PID, TID, UID) to every log record before it hits the sink. Enterprise deployments running multi-tenant workloads on a shared host use these fields to correlate log lines back to the specific process, thread, or user that produced them, without an off-line join against /proc.

Enricher trait

The Enricher trait is the extension point:

use rlg::log::Log;
use rlg_ebpf::{Enricher, ProcessEnricher};

let enricher = ProcessEnricher::new();
let log = Log::info("checkout completed");
let enriched = enricher.enrich(log);

assert!(enriched.attributes.contains_key("pid"));
assert!(enriched.attributes.contains_key("uid"));

EbpfEnricher (Phase 21.1 scaffold)

Enable the ebpf feature to expose a placeholder EbpfEnricher type. Its final implementation will attach an eBPF program via aya to hook into the kernel and pull network 4-tuple context from the socket layer. Landing in Phase 21.1.

Structs

Chain

Chain two enrichers. Applied left-to-right.

EbpfEnricherebpf

Kernel-side eBPF-backed enricher.

ProcessEnricher

Attaches process-level identity (PID, TID, UID) to every log.

Traits

Enricher

Attaches per-record context. Implementations are stateless from the caller’s perspective — they read process / kernel state on each call.