• 03 Mar 2023
  • 1 Minute to read
  • Contributors
  • Dark


  • Dark

Article Summary

The LimaCharlie Linux sensor interfaces with the kernel to acquire deep visibility into the host's activity while taking measures to preserve the host's performance. We make full use of eBPF, which requires Linux 4.4 or above.

The Sensor current supports all Linux distributions (including ARM and MIPS).

Linux Distribution Support

Our Linux Sensor fully utilizes eBPF, which requires at least Linux 4.4 or above. Use the command uname -r to check your kernel version to determine support.

Installation Instructions

Sensor installation instructions can be found here.

Supported Events

Supported Commands


Given configured paths to collect from, the Linux sensor can batch upload logs / artifacts directly from the host.

Learn more about collecting Artifacts here.


For more complex needs not supported by Events, Artifacts, or Commands, it's possible to execute payloads on hosts via the Linux sensor.

Learn more about executing Payloads here.

Was this article helpful?

What's Next