Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
How to Find Slow MongoDB Queries on Linux in 2026: The Slow Query Is Often Two Hundred Fast Ones
A slow-query log grades one query at a time, so an endpoint that issues two hundred fast queries produces an empty profiler and a 900ms response. Covers query shapes and N+1 detection, the profiler's 100ms threshold, Atlas Query Profiler, explain, mongotail, and reading the commands at the socket with mongosnoop and yeet.
How to Find Which Process Is Querying MongoDB on Linux in 2026: The Server Only Knows What the Client Told It
MongoDB's record of who connected is a handshake document the client wrote itself, carrying an address that any Docker NAT or Kubernetes node already rewrote. Covers appName, client metadata, currentOp, ss and lsof for socket ownership, and reading the sending pid off the socket with mongosnoop and yeet.
Writing an eBPF Protocol Tracer on Linux in 2026: Why the Verifier Wants Your Parser in Userspace
The verifier rejects a parsing loop because it cannot bound a trip count read from user memory, and that is design feedback rather than an obstacle. Compares bpftrace, BCC, libbpf and yeet, then covers back-edge errors, the 512-byte stack limit, per-CPU scratch maps, request/reply correlation and CO-RE field renames across kernels.
How to Check if a Linux Box Is Cryptomining in 2026: A kworker With a Socket Is Not a kworker
A kworker pegging a core is usually a firmware interrupt storm, but a kworker moving bytes to a mining pool is a renamed userspace process. Detect cryptojacking on Linux in 2026 by reading the name in the kernel at send time, after prctl(PR_SET_NAME) edited what ps and top show.
How to Sandbox and Monitor an AI Agent on Linux in 2026: Why a Proxy Can't Tell You Which Process Spoke
Five questions about an AI coding agent's egress that a MITM proxy, a container and an HTTPS_PROXY variable structurally cannot answer, ranked by how much of the answer survives the agent doing something you did not anticipate. Compared against AgentSight, Claude Code's built-in proxy, Dev Proxy, Landlock and microVMs, with the kernel hook that answers each and what it costs to run.
SQLite Has No Query Log. That's a Library Problem, Not a Logging Problem (2026)
SQLite has no server, so there is no daemon holding a log you could tail. The ecosystem answered that with sqlite3_trace_v2 and ORM echo flags, which are per-connection and need the app's cooperation. The shared libsqlite3 is a better place to stand, and here is what it costs you.
bpftrace vs BCC in 2026: Which One to Start Your eBPF Project With
Start with bpftrace unless your project already needs flags, floating-point math, or hosts with no compiler on them, in which case start with BCC. A side-by-side review of what each one installs, what each one refuses to do, the 512-byte stack limit that ends a bpftrace script, and how to tell today which one you will outgrow.
Top 5 Kernel Metrics Your APM Agent Misses in 2026: Ranked by How Often They End the Investigation
Five questions Datadog, Pixie, Coroot and node_exporter structurally cannot answer, ranked: off-CPU time, TCP retransmit attribution, per-disk latency histograms, runqueue delay, and the gap between what your app asked for and what reached the device. Each with the tool that gets it and what it costs to run.
How to Find Which Process Is Slowing Down Your Linux Machine: Blocked Is Not Busy
A process can look like it is eating your workstation while the kernel's own per-process accounting shows it barely ran. Read sum_exec_runtime and run_delay from /proc/PID/schedstat, the voluntary and nonvoluntary context switch counters from /proc/PID/status, and syscr against read_bytes from /proc/PID/io, and you can confirm or kill the theory with cat before installing a profiler.
How to Audit What an AI Coding Agent Actually Ran on Linux in 2026: The Log Stops Where the Shell Begins
Claude Code, Codex and Cursor all log their tool calls, and Anthropic documents the boundary in its own docs: OTEL_* is never passed to the subprocesses the Bash tool spawns. Compare what OpenTelemetry, an MCP gateway, auditd, strace and a kernel probe each record when an agent runs a shell one-liner, and see which one can name the commands underneath it.
How to Capture Packets on wg0 and Other Tunnel Interfaces on Linux: The Ethernet Header Is Not Missing, It Was Never There
Capturing on wg0, gre1 or tun0 hands you a bare IP packet, because a raw-IP tunnel device has no MAC header to give you; pktscope is a terminal packet analyzer whose TCX eBPF tap starts the snap at the MAC header on Ethernet-framed devices and at the network header on tunnels, so the decode and the hex offsets match the device you picked.
Why Is My Container Using More Memory Than the Process Inside It? (2026)
Your app reports 400MB of heap, the cgroup says 1.2GB, and the OOM killer believes the cgroup. Page cache, socket buffers, page tables and slab are all charged to your container and none of them appear in RSS. How to read memory.stat, tell reclaimable from pinned, and find the bytes nothing attributes.
Why Is My Redis Slow in 2026? How to See What Your App Is Actually Sending
Redis latency has two shapes: the server is blocked, or your app is asking too much. Slowlog, INFO commandstats and redis-cli --latency answer the first. None of them tell you which key pattern is eating your traffic or which process sent it. Here is how to read the traffic itself, live, with redissnoop and yeet.
How to Sandbox an AI Coding Agent on Linux in 2026: What the Kernel Can Refuse That Permissions Only Ask About
Claude Code, Codex, Aider and self-hosted agents run with your full filesystem access and choose what to read on their own — here are the six real ways to confine one, what each actually covers, and why the built-in sandboxes govern shell commands rather than the agent's own file reads.
How to Test and Debug WebSocket Traffic on Linux in 2026: Your Integration Test Asserts on the Client, Not the Wire
A WebSocket integration test asserts on what your client library returned, which is not what crossed the connection. How to see the real frames inside wss:// on Linux with wssnoop, Wireshark and a TLS keylog, mitmproxy and Chrome DevTools, and how to turn a captured session into a fixture your test suite can replay.
Traversal vs yeet: An AI SRE Reasons Over Your Telemetry, It Doesn't Collect It
Traversal's AI SRE runs causal search over the observability stack you already have, so its ceiling is what your instrumentation recorded; yeet is a JavaScript runtime for Linux ops that loads an eBPF probe for one missing fact while the incident is open. Which order to use them in, and how to test it against your own postmortems.
How to Monitor HTTP Traffic on Linux in 2026: What the Kernel Sees That Your Proxy Doesn't
A sidecar proxy sees the traffic you routed through it. The kernel's TC layer sees what actually crossed the wire, including loopback, without anything being rerouted. Compares OpenTelemetry, Envoy, tcpdump, Pixie, Cilium Hubble and httpwatch, and how to pick the one that answers your question.
How to Capture 802.11 Frames on a Connected Interface on Linux: Your Radio Already Hears Them
Monitor mode drops the association you are trying to diagnose, so airodump-ng and Kismet cannot watch the link you are standing on; airtop attaches eBPF fentry programs to mac80211 and cfg80211 to read 802.11 frames, RSSI in dBm and deauth counts on a normal connected Linux interface.
How to Monitor HTTP Traffic on Linux in 2026: Why the Kernel Sees What Your Access Log Doesn't
How to see the HTTP requests crossing a Linux host, including the ones your access log never records because they never reached a handler. Covers eBPF capture at the kernel's TC layer, tcpdump, Coroot, Pixie, Cilium Hubble, a proxy and OpenTelemetry, with the commands to run and the kernel version each one needs.
eBPF-Speed L7 Enforcement Without a CNI Migration
Cilium has the fastest datapath in Kubernetes networking, and its best modes are gated behind cluster-wide commitments — here is when that trade is worth making, and when enforcing at XDP without touching your CNI is the smaller move.