skills.rest
roanbrasil
roanbrasilCOMMUNITY
Explore all skills by this author →
Website𝕏@roanbrasilGitHub

ebpf-observability

Enable zero-instrumentation observability for Linux systems and Kubernetes clusters.

5|1|Updated Jun 17, 2026
Search Tags:#kubernetes#profiling#observability#ebpf#bpftrace#cilium#pixie
One-click install
npx skills add https://github.com/roanbrasil/engineer-grade-agent-skills --skill ebpf-observability
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ebpf-observability
Source: https://github.com/roanbrasil/engineer-grade-agent-skills/tree/main/skills/ebpf-observability
Command: npx skills add https://github.com/roanbrasil/engineer-grade-agent-skills --skill ebpf-observability

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Traditional observability solutions require application code changes, OpenTelemetry SDK integrations, and service redeploys to collect telemetry, and cannot capture kernel-level activity like syscalls, scheduler events, or raw network flows. This skill eliminates those constraints by enabling full-stack visibility via eBPF, with no modifications to application code or infrastructure.

Core Features & Use Cases

  • Ad-hoc kernel debugging: Use bpftrace one-liners and BCC tools to trace syscalls, network connections, JVM GC pauses, and I/O latency on production Linux systems without writing custom eBPF programs.
  • Kubernetes-native observability: Deploy Pixie for auto-instrumented service tracing, and Cilium with Hubble for eBPF-powered networking visibility, flow logging, and zero-config mTLS, replacing traditional service meshes.
  • Continuous profiling: Integrate Pyroscope with eBPF to collect CPU and memory profiles for all services, including legacy apps with no instrumentation, and correlate profiles with distributed traces in Grafana.
  • Use Case: Troubleshoot a slow payment service in a Kubernetes cluster by tracing kernel-level I/O latency with bpftrace, identifying network policy drops with Hubble, and profiling CPU usage with Pyroscope, all without redeploying the service.

Quick Start

Use the ebpf-observability skill to diagnose high latency for your Kubernetes frontend service by querying Pixie HTTP trace data and filtering for requests with p99 latency above 500ms.

Frequently Asked Questions about ebpf-observability

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I get observability for Kubernetes without modifying application code?▼

You can achieve zero-instrumentation observability for Kubernetes clusters by using eBPF-based tools like Pixie for auto-instrumented tracing and Cilium with Hubble for network visibility, eliminating the need for SDK integrations or service redeploys.

What's the best way to trace kernel-level I/O latency on a production Linux system?▼

Tracing kernel-level I/O latency on production Linux systems is best done using bpftrace one-liners and BCC tools, which allow you to capture syscalls, scheduler events, and I/O latency without writing custom eBPF programs.

Can I profile CPU and memory usage of legacy applications without adding OpenTelemetry SDKs?▼

Yes, you can profile CPU and memory usage for legacy applications lacking instrumentation by integrating Pyroscope with eBPF, which continuously collects profiles and correlates them with distributed traces in Grafana.

How does eBPF compare to traditional service meshes for network flow analysis?▼

eBPF provides network flow analysis and visibility using Cilium and Hubble, replacing traditional service meshes by offering zero-config mTLS and eBPF-powered flow logging directly at the kernel level without sidecars.

Do I need to redeploy my services to troubleshoot high latency with Pixie?▼

No, you do not need to redeploy services to troubleshoot high latency. You can query Pixie HTTP trace data directly to filter for requests with p99 latency above 500ms, diagnosing issues without service interruptions.

When should I not use eBPF-based observability instead of traditional OpenTelemetry SDKs?▼

You should avoid eBPF-based observability if you need to capture application-level business logic metrics that require explicit code-level instrumentation, as eBPF focuses on kernel-level activity, network flows, and system performance.

Related Skills

Explore More Software Engineering Skills→
mohitmishra786mohitmishra786
159

ebpf

Write, load, and debug eBPF programs for Linux observability and networking.

Community
Advanced
williamzujkowskiwilliamzujkowski
6

Observability Unified Dashboard

Designs unified observability dashboards correlating metrics, logs, and traces across Prometheus, Loki, Tempo, and Grafana 11.

Community
Advanced
rohitg00rohitg00
944

k8s-cilium

Observe and troubleshoot Cilium networking in Kubernetes clusters.

Community
Advanced
haxlyshaxlys

service-mesh-observability

Apply tracing, metrics, and visualization to diagnose service mesh latency and errors.

Community
Advanced