Skip to main content
Calico Cloud documentation

Collect L7 logs using the eBPF collector

Enable the kernel TCP-layer eBPF collector to capture HTTP request/response and TLS handshake metadata without deploying a proxy or injecting sidecars. You do not need the eBPF data plane to use it — the collector works with any Calico Cloud data plane (iptables, nftables, or eBPF). For background on what the collector does and how it compares to other options, see L7 logs overview.

Limitations​

  • HTTP parsing covers HTTP/1.0 and HTTP/1.1 only, because their requests and responses travel as plain text on the wire. HTTP/2 and HTTP/3 are not captured as HTTP, and encrypted HTTP traffic surfaces only as TLS metadata.
  • HTTP capture tracks only the most recent request per socket; when a single connection carries multiple back-to-back requests, some may be missed.
  • TLS capture is limited to handshake metadata (SNI, version, cipher suite). The collector does not decrypt application traffic.

Prerequisites​

  • Linux kernel 5.17 or later on every node.
  • Additional log storage for the L7 logs. L7 logs require a minimum of 1 additional GB of log storage per node, per one-day retention period.

Enable the collector​

  1. Enable the eBPF L7 collector by setting the L7ObservabilityEnabled field to true on the default FelixConfiguration. This setting is independent of the bpfEnabled field, so enabling the collector does not switch your data plane:

    kubectl patch felixconfiguration default --type=merge -p '{"spec":{"l7ObservabilityEnabled":true}}'

  2. Verify that L7 logs are being collected by looking for output in the default log file location (/var/log/calico/l7logs/l7.log) on each node. Logs are flushed on the interval set by the L7LogsFlushInterval field, so allow one interval to pass before you expect output:

    tail -f /var/log/calico/l7logs/l7.log

    The log directory is controlled by the L7LogsFileDirectory field on FelixConfiguration.

Additional information​