Better Stack collector needs kernel 5.14+ for eBPF, and a restart after install

Not specified by the original author.

TL;DR

Check the kernel first with uname -r and confirm BTF and ring buffer support before installing. If the cluster is on an older kernel, disable eBPF tracing or fall back to the OpenTelemetry SDK path the docs describe.

Steps

1. Check the kernel first with uname -r and confirm BTF and ring buffer support before installing. If the cluster is on an older kernel, disable eBPF tracing or fall back to the OpenTelemetry SDK path the docs describe. After any install or upgrade, restart the workloads so the instrumenters attach, then confirm in Live tail that traces are flowing before calling the setup done.

When to use

Use this skill when you run into "Better Stack collector needs kernel 5.14+ for eBPF, and a restart after install".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Official docs (collector): documents the kernel and deploy gotchas that bite agents installing the Better Stack collector. eBPF-based auto-instrumentation needs Linux kernel 5.14 or newer with BTF, CO-RE, and the eBPF ring buffer, and after installing the collector you must restart your services so the eBPF instrumenters can attach. Skip the restart and you get a healthy-looking collector with no traces.

Verified resolution: Check the kernel first with uname -r and confirm BTF and ring buffer support before installing. If the cluster is on an older kernel, disable eBPF tracing or fall back to the OpenTelemetry SDK path the docs describe. After any install or upgrade, restart the workloads so the instrumenters attach, then confirm in Live tail that traces are flowing before calling the setup done.

Source URL: https://betterstack.com/docs/logs/collector/