Lexicon
eBPF
eBPF runs sandboxed programs inside the Linux kernel, enabling telemetry with no code changes. How it works for observability and where its limits sit.
Definition
eBPF is a Linux kernel technology that runs small, verified programs inside the kernel itself, attached to events like system calls, network packets, and scheduler activity. For observability, it means telemetry can be captured at the kernel boundary with no changes to application code.
What it means in observability
eBPF's promise is instrumentation free visibility. Because every network request, file operation, and process event passes through the kernel, programs attached there can observe any application in any language, including the third party binaries and legacy services you could never instrument. That makes eBPF the fastest route to baseline coverage across a messy estate, and it powers a growing family of tools for network observability, continuous profiling, and automatic service level metrics.
How it works in practice
Programs are written against kernel hooks, verified for safety before loading, and run in a sandbox with strict limits, which is what makes running them in production tenable. For observability, agents built on eBPF watch kernel events, reconstruct higher level activity such as HTTP requests from raw socket data, and export the results, increasingly as OpenTelemetry signals, so kernel derived telemetry flows through the same pipelines as everything else.
Where it gets hard
The kernel giveth and the kernel constraineth. Capabilities vary by kernel version, agents need privileged access that security teams rightly scrutinize, and the raw event volume demands careful in kernel filtering. The deeper limit is semantic: eBPF sees what the kernel sees, packets and syscalls, not what your business logic means. It can tell you a request happened; it cannot attach the customer ID. In practice eBPF complements code level instrumentation rather than replacing it.
Where Tsuga fits
Telemetry from eBPF based agents that export OpenTelemetry flows into Tsuga like any other source, over OTLP, and lands with full resource context. Kernel level breadth and code level depth end up in the same correlated dataset.
Related terms
- Infrastructure monitoringInfrastructure monitoring is the practice of tracking the health, performance, and capacity of the layer applications run on: hosts, virtual machines, containers, Kubernetes clusters, and managed cloud services.
- InstrumentationInstrumentation is the code, runtime configuration, or platform setup that makes software emit telemetry.
- Kubernetes monitoringKubernetes monitoring is observability applied to Kubernetes clusters: the nodes, workloads, pods, and containers that run modern applications, plus the control plane that orchestrates them.
- OpenTelemetryOpenTelemetry is an open source framework for generating, collecting, and exporting telemetry: the logs, metrics, and traces that describe how software behaves in production.