Trying to load kprobes on ubuntu 4.15.0, I get the following error: libbpf: load bpf program failed: Invalid argument The same kprobes load successfully using bcc After some digging, I found that the issue was with the kernel version given to the bpf syscall. While libbpf calculated the value 265984 for the kern_version argument, bcc used 266002. It turns out that some distros (e.g. ubuntu, debian) change the patch number of the kernel version, as detailed in: https://github.com/ajor/bpftrace/issues/8 I didn't find a proper API in libbpf to load kprobes in such cases - is there any?
