Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
AlleBPF24linux23yeet20observability12AI agents5security5networking4uprobes4kubernetes3tcpdump3tracing3audit2bcc2BSON2containers2execsnoop2HTTP2MongoDB2process-attribution2supply chain2802.111ai-sre1biolatency1bpf-verifier1bpftrace1cgroups1ci1Cilium1claude-code1CO-RE1context-switches1cpu-accounting1cryptojacking1egress1exectop1exfiltration1incident-response1integration-testing1kprobes1kworker1MCP1memory1n-plus-one1off-cpu1oom1opentelemetry1packet-capture1prepared statements1proc-filesystem1process-masquerading1processes1profiling1query-shapes1Redis1RESP1rf1root-cause-analysis1runqlat1schedstat1slowlog1SQLite1stratum1tcp-retransmits1tunnels1websocket1wifi1wireguard1wireless1wss1
See Every Process a Command Starts on Linux in 2026: My Honest Review of execsnoop
execsnoop hands you a firehose: one line per execve(), host-wide, perfect for grep and unreadable when you read it yourself. An honest review of where that shape stops working, and the execve-only and 20-argument limits behind it.
execsnoopbcceBPFprocessestracinglinuxyeet
Read more →How to See Every Command Your Build Runs in CI on Linux: Capturing Them Is the Easy Part
Every exec a build starts is already visible to the kernel through the sched_process_exec tracepoint, so the hard part is volume and scope: execsnoop, strace -f, auditd, set -x and exectop compared on what each one can scope to one process tree and what each does with 7,745 lines of output.
exectopexecsnoopcisupply-chainobservabilityeBPFlinuxyeet
Read more →