---
title: "Collect L7 logs using the eBPF collector"
description: "Enable the kernel TCP-layer eBPF collector to capture HTTP and TLS L7 logs without a proxy or sidecar."
product: "Calico Cloud"
version: "v24.0.0"
section: "Observability"
canonical_url: "https://docs.tigera.io/calico-cloud/observability/elastic/l7/enable-ebpf-collector"
---

# Collect L7 logs using the eBPF collector

Enable the kernel TCP-layer eBPF collector to capture HTTP request/response and TLS handshake metadata without deploying a proxy or injecting sidecars. You do not need the eBPF data plane to use it — the collector works with any Calico Cloud data plane (iptables, nftables, or eBPF). For background on what the collector does and how it compares to other options, see [L7 logs overview](https://docs.tigera.io/calico-cloud/observability/elastic/l7/overview.md).

## Limitations

- HTTP parsing covers HTTP/1.0 and HTTP/1.1 only, because their requests and responses travel as plain text on the wire. HTTP/2 and HTTP/3 are not captured as HTTP, and encrypted HTTP traffic surfaces only as TLS metadata.
- HTTP capture tracks only the most recent request per socket; when a single connection carries multiple back-to-back requests, some may be missed.
- TLS capture is limited to handshake metadata (SNI, version, cipher suite). The collector does not decrypt application traffic.

## Prerequisites

- Linux kernel 5.17 or later on every node.
- Additional log storage for the L7 logs. L7 logs require a minimum of 1 additional GB of log storage per node, per one-day retention period.

## Enable the collector

1. Enable the eBPF L7 collector by setting the [L7ObservabilityEnabled](https://docs.tigera.io/calico-cloud/reference/component-resources/node/felix/configuration.md#L7ObservabilityEnabled) field to `true` on the default `FelixConfiguration`. This setting is independent of the `bpfEnabled` field, so enabling the collector does not switch your data plane:

   ```bash
   kubectl patch felixconfiguration default --type=merge -p '{"spec":{"l7ObservabilityEnabled":true}}'
   ```

2. Verify that L7 logs are being collected by looking for output in the default log file location (`/var/log/calico/l7logs/l7.log`) on each node. Logs are flushed on the interval set by the [L7LogsFlushInterval](https://docs.tigera.io/calico-cloud/reference/component-resources/node/felix/configuration.md#L7LogsFlushInterval) field, so allow one interval to pass before you expect output:

   ```bash
   tail -f /var/log/calico/l7logs/l7.log
   ```

   The log directory is controlled by the [L7LogsFileDirectory](https://docs.tigera.io/calico-cloud/reference/component-resources/node/felix/configuration.md#L7LogsFileDirectory) field on `FelixConfiguration`.

## Additional information

- [L7 log data types](https://docs.tigera.io/calico-cloud/observability/elastic/l7/datatypes.md)
- [Log aggregation](https://docs.tigera.io/calico-cloud/observability/elastic/aggregation.md)