kprobe is a flight recorder for the layer your APM cannot see.
Modern observability explains application behavior. kprobe explains what the Linux kernel did underneath it: scheduling, syscalls, memory pressure, TCP timing, and the causal chain that connects those events to a failed request.
The hard incidents happen below your code.
A slow span can be a slow service, a scheduler delay, a memory reclaim storm, or a TCP retransmit. Application tools see the symptom. kprobe records the system events that explain the cause.
It complements your observability stack.
Keep Datadog, Prometheus, Jaeger, and OpenTelemetry. kprobe extends them downward into the host, then maps kernel events back to the services, pods, traces, and transactions engineers already use.
kprobe is
- A passive kernel event recorder
- A causal inference engine
- An incident replay system
- A debugging layer for platform teams
kprobe is not
- A replacement for APM or metrics
- A generic dashboarding platform
- A threshold alerting tool
- Useful without Linux host visibility
Observe without changing the app
No SDK, import, sidecar, or redeploy. The recorder attaches at the kernel.
Explain cause, not just sequence
Events become inspectable edges so engineers can see why a request failed.
Turn incidents into test cases
Replay preserves the production event timeline so fixes can be tested against reality.