Topical Takes

Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.

AlleBPF30linux29yeet26observability12AI agents9security7networking4uprobes4claude-code3exectop3kubernetes3supply chain3tcpdump3tracing3audit2bcc2BSON2ci2containers2execsnoop2HTTP2incident-response2MongoDB2process-attribution2processes2802.111agent-security1ai-sre1auditd1biolatency1bpf-verifier1bpftrace1build-performance1capabilities1cgroups1Cilium1CO-RE1confidential-computing1context-switches1cpu-accounting1cryptojacking1egress1exfiltration1integration-testing1kprobes1kworker1local-llm1make1MCP1memory1n-plus-one1nodejs1npm1off-cpu1ollama1oom1opentelemetry1packet-capture1postinstall1prepared statements1proc-filesystem1process-masquerading1production1profiling1query-shapes1Redis1RESP1rf1root-cause-analysis1runqlat1sandboxing1schedstat1slowlog1SQLite1ssh1stratum1sudo1tcp-retransmits1threat-modeling1tunnels1websocket1wifi1wireguard1wireless1wss1+85 more

All eBPF30 linux29 yeet26 observability12 AI agents9 security7 networking4 uprobes4 claude-code3 exectop3 kubernetes3 supply chain3 tcpdump3 tracing3 audit2 bcc2 BSON2 ci2 containers2 execsnoop2 HTTP2 incident-response2 MongoDB2 process-attribution2 processes2 802.111 agent-security1 ai-sre1 auditd1 biolatency1 bpf-verifier1 bpftrace1 build-performance1 capabilities1 cgroups1 Cilium1 CO-RE1 confidential-computing1 context-switches1 cpu-accounting1 cryptojacking1 egress1 exfiltration1 integration-testing1 kprobes1 kworker1 local-llm1 make1 MCP1 memory1 n-plus-one1 nodejs1 npm1 off-cpu1 ollama1 oom1 opentelemetry1 packet-capture1 postinstall1 prepared statements1 proc-filesystem1 process-masquerading1 production1 profiling1 query-shapes1 Redis1 RESP1 rf1 root-cause-analysis1 runqlat1 sandboxing1 schedstat1 slowlog1 SQLite1 ssh1 stratum1 sudo1 tcp-retransmits1 threat-modeling1 tunnels1 websocket1 wifi1 wireguard1 wireless1 wss1

September 8, 2026

See Every Process a Command Starts on Linux in 2026: My Honest Review of execsnoop

execsnoop hands you a firehose: one line per execve(), host-wide, perfect for grep and unreadable when you read it yourself. An honest review of where that shape stops working, and the execve-only and 20-argument limits behind it.

execsnoopbcceBPFprocessestracinglinuxyeet

September 4, 2026

How to See Every Command Your Build Runs in CI on Linux: Capturing Them Is the Easy Part

Every exec a build starts is already visible to the kernel through the sched_process_exec tracepoint, so the hard part is volume and scope: execsnoop, strace -f, auditd, set -x and exectop compared on what each one can scope to one process tree and what each does with 7,745 lines of output.

exectopexecsnoopcisupply-chainobservabilityeBPFlinuxyeet