This guide collects Linux kernel and userland settings for improving security and usability, targeting Arch Linux and potentially other distributions.
Tracee
Tracee monitors runtime security events and supports forensic analysis with eBPF instrumentation.
About Tracee
Tracee is a runtime security and observability tool for Linux systems. It uses eBPF instrumentation to monitor system calls, process execution, file operations, and network activity in real time, and it generates events that can be used for security detection and forensic analysis. The source describes uses including security monitoring, compliance-related file and data monitoring, troubleshooting, and investigating incidents with audit trails.
The source states that Tracee should run on most common Linux distributions and kernels, and it points to a Prerequisites page for compatibility details. Mac users are referred to a separate FAQ. The Docker quickstart runs the container with privileged mode, host PID and cgroup namespaces, and read-only mounts of host paths. The Kubernetes option installs through a Helm chart.
Key features
- Monitors system calls, process execution, file operations, and network activity
- Uses eBPF to observe Linux systems in real time
- Monitors existing applications without code changes or modification
- Native support for containerized environments and Kubernetes
- Customizable policies that set what is monitored and how events are handled
- Event data with process lineage, file paths, and network connections
Best for: Linux system administrators, security analysts, and DevOps engineers who need runtime visibility into system and container behavior.
Good for
- Monitors existing applications without requiring modification to them
- The source describes low overhead from efficient eBPF programs
- Event data includes process lineage, file paths, and network connections
Watch out for
- The quickstart is written for Linux, and Mac users are referred to a separate FAQ
- The Docker quickstart runs with privileged mode and host namespaces, which broadens the container's access
- Compatibility depends on the Linux distribution and kernel, as described on the Prerequisites page
Tracee at a glance
- Category
- Privacy & Security › Desktop & OS Privacy
- Type
- Website
- Pricing
- Not confirmed. Check the site
- Platforms
- Linux, Web
- Open source
- Not stated
- Language
- English
- Last checked
- Oct 6, 2026 · Online when checked
- Listed
- Oct 5, 2026
Tracee alternatives
Tools and sites you could use instead, ranked by how closely they match.
Qubes OS is a free, open-source operating system for personal computers that uses compartmentalization as a security approach.
This community guide collects recommendations for improving security and privacy on macOS.
Open source
24 alternatives
Follow this evolving guide for steps and configuration examples to secure a Linux server.
Set USB device authorization rules with USBGuard, a framework for controlling device access.
Open source
24 alternatives
Authorize binary execution and file access on macOS with Santa, a system extension and policy tool.
Open source
24 alternativesPopular in Desktop & OS Privacy
Well-known listings from the same topic.
wBlockapps.apple.com/app/wblock/id6746388723uBO Lite Safariapps.apple.com/app/ublock-origin-lite/id674534…Stayapps.apple.com/app/stay-for-safari/id1591620171Lockdown Privacylockdownprivacy.comTor Browsertorproject.orgFirejailfirejail.wordpress.com
Tracee FAQ
Which systems does Tracee run on?
The source says Tracee should run on most common Linux distributions and kernels. It refers readers to the Prerequisites page for compatibility information.
How can Tracee be deployed on Kubernetes?
The source gives a Helm-based quickstart: add the Aqua Helm repository, update it, install the tracee chart into a tracee namespace, and follow the daemonset logs.
Is something wrong or out of date?
Tell us and an editor will check it.
Own this website?
Claim this listing
Claim the listing and suggest updates yourself. An editor checks every claim first.