fProcessor: NonIntrusive and On-the-Fly File Data Preprocessing Using eBPF

This paper introduces fProcessor, a tool designed for nonintrusive, on-the-fly preprocessing of data being written to files. “Nonintrusive” means that fProcessor requires no modifications to existing code, allowing applications to remain unaware of the monitoring activities. “On-the-fly” indicates that fProcessor dynamically executes preprocessing operations on file contents during the write process. It supports three common preprocessing operations: tracking, detection, and reduction. These operations are applicable in scenarios such as capturing log file content, filtering data being written, and reducing file content to conserve storage space. Traditionally, these tasks necessitate specific application-layer code. In contrast, fProcessor intercepts file content at the Linux kernel level, simplifying the development of application-layer code. The advantage of fProcessor lies in its use of eBPF technology to implement file preprocessing, demonstrating low runtime overhead and enabling efficient data processing. fProcessor is free and open source software (https://github.com/Prometheus-first/fProcessor)