FAQ
Does kprobe work on macOS?
The eBPF probe requires Linux kernel 5.15+ and will not run on macOS. For development, use a Linux VM, GitHub Codespaces, or any Linux cloud instance.
The rest of kprobe — causal engine, API server, replay engine, dashboard — can run natively on macOS for local development. Only the probe itself requires Linux.
What is the performance overhead?
Typical overhead is under 1% CPU per node and approximately 200MB of additional memory. Latency added to instrumented syscalls is under 1 microsecond.
The probe can be tuned to reduce overhead by disabling specific hooks. See Configuration for details.
Does kprobe require changes to my application?
No. kprobe attaches to the kernel and captures events without any application code changes, library imports, or redeployment. It works with any language, any framework, and any existing observability setup.
If your kernel event stream already carries trace context, kprobe will attach it to events. Native OpenTelemetry span correlation is planned next. Without trace context, kprobe still works — it just has less application context to attach to kernel events.
Does it work with any Kubernetes distribution?
kprobe works with any Kubernetes distribution running on Linux kernel 5.15+ with BTF support. Tested distributions include:
- EKS (AL2023 nodes)
- GKE (Container-Optimized OS)
- AKS (Ubuntu node pools)
- Self-managed clusters on Ubuntu 22.04+
How does kprobe know which kernel event belongs to which request?
kprobe links kernel events using transaction ID, trace ID, service name, process ID, and timestamp when those fields are present. The planned OpenTelemetry integration will join spans to kernel events using process ID and timestamp so kprobe can link the kernel event to the request, transaction, or job.
If you do not use OpenTelemetry, kprobe can still group events by PID and timestamp but will not have named application context.
What happens if the causal engine falls behind?
Events queue in Kafka. Kafka is configured with durable retention (default 24 hours). If the causal engine falls behind under load, it will catch up when load drops. No events are lost.
Can I query the data directly?
Yes. ClickHouse is accessible at port 8123 and Neo4j at port 7474. Use ClickHouse’s HTTP interface for SQL queries over raw events. Use the Neo4j Browser for Cypher queries over the causal graph.
Is the replay engine safe to run in production?
The replay engine uses ptrace to sandbox a process. It is designed for development machines, not production. Running replay in production would intercept the syscalls of a real process and serve recorded responses — this would break the process. Always run replay locally or in a dedicated staging environment.
How long does it take to get the first causal graph?
After deployment, the probe starts capturing events immediately. The first causal graph for a transaction will appear in the dashboard within a few seconds of the transaction completing — the time it takes for events to flow through Kafka, be correlated by Vector, and be processed by the causal engine.
Does kprobe support Windows or other operating systems?
No. eBPF is a Linux kernel technology. kprobe is Linux-only.