DeepFactor’s runtime telemetry support code is provided in a shared library called libdf.so. This library is loaded into an application when it starts. The telemetry support code is written to instrument calls by an application to the underlying C runtime library (glibc or musl, based on the Linux distribution). Some types of applications do not directly use the C runtime library and thus fewer telemetry events will be collected for analysis. These include statically linked applications and applications written in Go.
Applications that have a set of capabilities registered with Linux (eg, by using the setcap(8) program) or protected by AppArmor/SELinux may not allow the DeepFactor shared library to load. In this case, no telemetry will be gathered. This also applies to applications whose setuid/setgid bit is set. This can be fixed by running the instrumented executable without this configuration; remember to re-enable such protections before deploying the application to production.