| name | ebpf-observability |
| description | Implement eBPF-based observability for deep kernel-level insights without application instrumentation. Outputs eBPF tool selection, network tracing, performance profiling, and security monitoring patterns. |
| argument-hint | ["Linux kernel version","observability gaps","performance issues","security requirements"] |
| allowed-tools | Read, Write, Bash |
eBPF Observability
eBPF (extended Berkeley Packet Filter) runs sandboxed programs in the Linux kernel without modifying kernel source or loading kernel modules. This enables observability that was previously impossible or required heavy instrumentation: network packet tracing, CPU profiling, syscall monitoring, and security policy enforcement — all with minimal overhead.
What eBPF Enables
NETWORK OBSERVABILITY
Per-connection latency (TCP RTT, handshake time)
Packet drops and retransmits
DNS query tracing (without touching application code)
Service-to-service communication mapping
PERFORMANCE PROFILING
CPU flame graphs (which functions consume CPU)
Memory allocation tracing
Disk I/O patterns (which processes, which files)
Lock contention
SECURITY MONITORING
Syscall auditing (process executions, file opens, network connections)
Privilege escalation detection
Container escape attempts
Runtime security policy enforcement (Cilium, Falco)
APPLICATION OBSERVABILITY (zero instrumentation)
HTTP request/response tracing via user space probes
Database query timing
Language-specific JIT profiling (Go, Java, Python)
Tool Selection
BCC (BPF Compiler Collection) — Python/C scripting
bpftrace: awk-like one-liners for tracing
execsnoop, opensnoop, tcpconnect — pre-built tools
Pixie — Kubernetes-native, auto-instrumentation
Zero code changes; install once per cluster
Service maps, SQL queries, HTTP latency — all automatic
Cilium — Network policy + observability
eBPF-powered networking and security for Kubernetes
Hubble: network flow visibility
Falco — Runtime security
Detects anomalous behaviour using eBPF (or kernel module)
Pre-built rules for known attack patterns
Parca / Pyroscope — Continuous profiling
Always-on CPU and memory profiling via eBPF
No code changes required
