System Flow

kprobe turns low-level runtime activity into a searchable incident explanation.

End-to-end flow

1. A production workload runs on Linux.
2. The recorder captures kernel events with eBPF.
3. Events are streamed through the pipeline.
4. Enrichment adds service, trace, and transaction context.
5. Timeline storage preserves the ordered event history.
6. The causal engine creates graph relationships.
7. The API exposes timelines, graphs, and replay sessions.
8. The console helps engineers investigate the incident.

Example payment flow

payment-api receives pay_123
  -> ledger-service starts database write
  -> kernel issues block I/O
  -> write waits behind compaction traffic
  -> ledger-service misses timeout
  -> payment fails

kprobe records both sides of the incident:

  • the application context: payment, service, trace, span
  • the kernel cause: block I/O delay, syscall duration, scheduler behavior

What makes kprobe different

Most observability tools are application-up. kprobe is kernel-up.

Application-up tools answer:

Which service was slow?

kprobe answers:

What did the kernel do underneath that made the service slow?