Topical Takes

Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.

AlleBPF22linux21yeet18observability11AI agents5security5networking4uprobes4kubernetes3tcpdump3audit2BSON2containers2HTTP2MongoDB2process-attribution2tracing2802.111ai-sre1bcc1biolatency1bpf-verifier1bpftrace1cgroups1Cilium1claude-code1CO-RE1context-switches1cpu-accounting1cryptojacking1egress1exfiltration1incident-response1integration-testing1kprobes1kworker1MCP1memory1n-plus-one1off-cpu1oom1opentelemetry1packet-capture1prepared statements1proc-filesystem1process-masquerading1profiling1query-shapes1Redis1RESP1rf1root-cause-analysis1runqlat1schedstat1slowlog1SQLite1stratum1supply chain1tcp-retransmits1tunnels1websocket1wifi1wireguard1wireless1wss1+65 more

August 31, 2026

How to Find Slow MongoDB Queries on Linux in 2026: The Slow Query Is Often Two Hundred Fast Ones

A slow-query log grades one query at a time, so an endpoint that issues two hundred fast queries produces an empty profiler and a 900ms response. Covers query shapes and N+1 detection, the profiler's 100ms threshold, Atlas Query Profiler, explain, mongotail, and reading the commands at the socket with mongosnoop and yeet.

MongoDBeBPFlinuxobservabilityn-plus-onequery-shapesBSONyeet

August 31, 2026

Writing an eBPF Protocol Tracer on Linux in 2026: Why the Verifier Wants Your Parser in Userspace

The verifier rejects a parsing loop because it cannot bound a trip count read from user memory, and that is design feedback rather than an obstacle. Compares bpftrace, BCC, libbpf and yeet, then covers back-edge errors, the 512-byte stack limit, per-CPU scratch maps, request/reply correlation and CO-RE field renames across kernels.

eBPFbpf-verifierCO-REkprobesBSONlinuxtracingyeet