Topical Takes

Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.

AlleBPF51linux51yeet48AI agents23observability16networking8claude-code7security7HTTP4production4tracing4API debugging3bcc3exectop3incident-response3kubernetes3omarchy3sandboxing3supply chain3tcpdump3troubleshooting3uprobes3audit2auditd2bpftrace2BSON2capabilities2ci2containers2databases2debugging2egress2execsnoop2hyprland2MongoDB2mysql2oom2performance2permissions2postgres2processes2quickshell2runtime-debugging2ssh2TCP2TLS2802.111agent-security1agentic network operations1ai-sre1bar-widget1benchmarks1biolatency1bpf-verifier1bubblewrap1build-performance1cgroups1Cilium1CO-RE1codex1confidential-computing1context-switches1cpu-accounting1cryptojacking1devops1DNS1exfiltration1hardening1integration-testing1kprobes1kworker1landlock1latency1local-llm1make1MCP1memory1n-plus-one1nodejs1npm1off-cpu1ollama1opentelemetry1packet-capture1plugin1postinstall1prepared statements1privilege1proc-filesystem1process-attribution1process-masquerading1proctop1profiling1query-shapes1Redis1refusal1RESP1rf1root-cause-analysis1runqlat1schedstat1seccomp1slowlog1SQLite1stratum1sudo1syscall1systemd1tcp-retransmits1terminal-bench1threat-modeling1tunnels1websocket1wifi1wireguard1wireless1wss1yeetkit1+118 more

All eBPF51 linux51 yeet48 AI agents23 observability16 networking8 claude-code7 security7 HTTP4 production4 tracing4 API debugging3 bcc3 exectop3 incident-response3 kubernetes3 omarchy3 sandboxing3 supply chain3 tcpdump3 troubleshooting3 uprobes3 audit2 auditd2 bpftrace2 BSON2 capabilities2 ci2 containers2 databases2 debugging2 egress2 execsnoop2 hyprland2 MongoDB2 mysql2 oom2 performance2 permissions2 postgres2 processes2 quickshell2 runtime-debugging2 ssh2 TCP2 TLS2 802.111 agent-security1 agentic network operations1 ai-sre1 bar-widget1 benchmarks1 biolatency1 bpf-verifier1 bubblewrap1 build-performance1 cgroups1 Cilium1 CO-RE1 codex1 confidential-computing1 context-switches1 cpu-accounting1 cryptojacking1 devops1 DNS1 exfiltration1 hardening1 integration-testing1 kprobes1 kworker1 landlock1 latency1 local-llm1 make1 MCP1 memory1 n-plus-one1 nodejs1 npm1 off-cpu1 ollama1 opentelemetry1 packet-capture1 plugin1 postinstall1 prepared statements1 privilege1 proc-filesystem1 process-attribution1 process-masquerading1 proctop1 profiling1 query-shapes1 Redis1 refusal1 RESP1 rf1 root-cause-analysis1 runqlat1 schedstat1 seccomp1 slowlog1 SQLite1 stratum1 sudo1 syscall1 systemd1 tcp-retransmits1 terminal-bench1 threat-modeling1 tunnels1 websocket1 wifi1 wireguard1 wireless1 wss1 yeetkit1

August 31, 2026

How to Find Slow MongoDB Queries on Linux in 2026: The Slow Query Is Often Two Hundred Fast Ones

A slow-query log grades one query at a time, so an endpoint that issues two hundred fast queries produces an empty profiler and a 900ms response. Covers query shapes and N+1 detection, the profiler's 100ms threshold, Atlas Query Profiler, explain, mongotail, and reading the commands at the socket with mongosnoop and yeet.

MongoDBeBPFlinuxobservabilityn-plus-onequery-shapesBSONyeet

August 31, 2026

How to Find Which Process Is Querying MongoDB on Linux in 2026: The Server Only Knows What the Client Told It

MongoDB's record of who connected is a handshake document the client wrote itself, carrying an address that any Docker NAT or Kubernetes node already rewrote. Covers appName, client metadata, currentOp, ss and lsof for socket ownership, and reading the sending pid off the socket with mongosnoop and yeet.

MongoDBeBPFlinuxprocess-attributioncontainersuprobesobservabilityyeet