Architecture at a Glance

kprobe is deployed beside your production workloads. It records kernel activity from each node, enriches that activity with application context, stores timelines, builds causal graphs, and exposes the results through a console and API.

High-level flow

Production workloads
  -> Linux kernel events
  -> kprobe recorder agents
  -> event pipeline
  -> enrichment and trace correlation
  -> timeline storage
  -> causal graph storage
  -> API and console

Component map

┌─────────────────────────────────────────────────────────────┐
│ Production environment                                      │
│                                                             │
│  payment-api     ledger-service     database worker         │
│      │                │                    │                │
│      └──────── Linux kernel events ────────┘                │
│                       │                                     │
│                       ▼                                     │
│                kprobe recorder                              │
└───────────────────────┼─────────────────────────────────────┘
                        │
                        ▼
              Event pipeline / streaming
                        │
                        ▼
              Enrichment and correlation
                        │
          ┌─────────────┴─────────────┐
          ▼                           ▼
  Timeline storage              Causal graph storage
          │                           │
          └─────────────┬─────────────┘
                        ▼
                  kprobe API
                        │
                        ▼
                  kprobe console

Components

Component	Responsibility
Recorder	Runs on each node or host and captures kernel events with eBPF.
Event pipeline	Buffers, validates, and routes high-volume event streams.
Enrichment	Adds service, trace, pod, transaction, and request context.
Timeline store	Stores ordered event history for queries and replay.
Causal graph store	Stores event relationships for root-cause traversal.
API	Serves events, graphs, replay sessions, and live streams.
Console	Provides timeline, graph, search, replay, and incident views.

Deployment shapes

In Kubernetes, the recorder runs as a DaemonSet. One recorder runs on every node that may execute observed workloads.

In ECS on EC2 or bare Linux, the recorder runs as a privileged host agent.

In Fargate-only environments, kprobe can ingest traces and application context, but full host-kernel eBPF recording requires EC2-backed compute.

Design principles

• Capture below the application layer.
• Preserve enough context to tie events back to real requests.
• Keep raw timelines queryable.
• Make causal claims inspectable.
• Treat replay as an investigation tool, not a dashboard animation.