coroot

Identify and analyze kernel-level incidents using Coroot observability data.

387|68|Updated Jan 22, 2026
One-click install
npx skills add https://github.com/Arvo-AI/aurora --skill coroot
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: coroot
Source: https://github.com/Arvo-AI/aurora/tree/main/server/chat/backend/agent/skills/integrations/coroot
Command: npx skills add https://github.com/Arvo-AI/aurora --skill coroot

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Coroot provides kernel-level observability to capture data that application-level metrics and logs miss, enabling accurate incident RCA, root-cause analysis, and risk assessment across complex infrastructures.

Core Features & Use Cases

  • eBPF-powered data collection: captures kernel-level metrics including TCP connections, DNS queries, disk I/O, and per-container resource usage.
  • Service map and topology, incident RCA: builds a live view of dependencies and enables end-to-end RCA across services, deployments, and nodes.
  • Traces, logs, and costs/risk insights: correlates traces with logs and computes cost and risk signals for informed remediation.
  • Use Case: during a cloud incident, correlate kernel-level events with application logs to determine if the root cause is a resource contention or a failed dependency.

Quick Start

Run coroot_get_incidents to fetch recent incidents and review their RCA summaries.

Frequently Asked Questions about coroot

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How does eBPF kernel-level observability help with incident root cause analysis?

eBPF kernel-level observability captures TCP connections, DNS queries, and disk I/O that application-level metrics miss, providing accurate incident root cause analysis across complex infrastructures.

How do I investigate cloud incidents using kernel-level traces and logs?

To investigate cloud incidents, run coroot_get_incidents to fetch recent incidents. This correlates kernel-level events with application logs to determine if root causes are resource contention or failed dependencies.

Can I perform cross-cluster incident investigation and cross-resource correlation?

Yes, cross-cluster incident investigation applies across clusters for RCA detail and cross-resource correlation. Connectivity checks are required before querying data sources to fetch accurate incident summaries.

What is the best way to correlate traces with logs for cost and risk assessment?

The best way to correlate traces with logs for cost and risk assessment is using eBPF-powered data collection, which computes cost and risk signals for informed remediation across services and deployments.

Why do application-level metrics and logs miss infrastructure-level root causes?

Application-level metrics and logs miss root causes because they lack kernel-level visibility. eBPF captures per-container resource usage and dependencies, building a live service map to reveal resource contention issues.

Do I need specific tools or connectivity checks before fetching incident RCA summaries?

Yes, you need the coroot tools listed in the metadata and must pass connectivity checks before querying data sources to successfully fetch incident RCA summaries and review them.