Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
See Every Process a Command Starts on Linux in 2026: My Honest Review of execsnoop
execsnoop hands you a firehose: one line per execve(), host-wide, perfect for grep and unreadable when you read it yourself. An honest review of where that shape stops working, and the execve-only and 20-argument limits behind it.
Writing an eBPF Protocol Tracer on Linux in 2026: Why the Verifier Wants Your Parser in Userspace
The verifier rejects a parsing loop because it cannot bound a trip count read from user memory, and that is design feedback rather than an obstacle. Compares bpftrace, BCC, libbpf and yeet, then covers back-edge errors, the 512-byte stack limit, per-CPU scratch maps, request/reply correlation and CO-RE field renames across kernels.
bpftrace vs BCC in 2026: Which One to Start Your eBPF Project With
Start with bpftrace unless your project already needs flags, floating-point math, or hosts with no compiler on them, in which case start with BCC. A side-by-side review of what each one installs, what each one refuses to do, the 512-byte stack limit that ends a bpftrace script, and how to tell today which one you will outgrow.