Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
AlleBPF22linux21yeet18observability11AI agents5security5networking4uprobes4kubernetes3tcpdump3audit2BSON2containers2HTTP2MongoDB2process-attribution2tracing2802.111ai-sre1bcc1biolatency1bpf-verifier1bpftrace1cgroups1Cilium1claude-code1CO-RE1context-switches1cpu-accounting1cryptojacking1egress1exfiltration1incident-response1integration-testing1kprobes1kworker1MCP1memory1n-plus-one1off-cpu1oom1opentelemetry1packet-capture1prepared statements1proc-filesystem1process-masquerading1profiling1query-shapes1Redis1RESP1rf1root-cause-analysis1runqlat1schedstat1slowlog1SQLite1stratum1supply chain1tcp-retransmits1tunnels1websocket1wifi1wireguard1wireless1wss1
How to Find Slow MongoDB Queries on Linux in 2026: The Slow Query Is Often Two Hundred Fast Ones
A slow-query log grades one query at a time, so an endpoint that issues two hundred fast queries produces an empty profiler and a 900ms response. Covers query shapes and N+1 detection, the profiler's 100ms threshold, Atlas Query Profiler, explain, mongotail, and reading the commands at the socket with mongosnoop and yeet.
MongoDBeBPFlinuxobservabilityn-plus-onequery-shapesBSONyeet
Read more →How to Find Which Process Is Querying MongoDB on Linux in 2026: The Server Only Knows What the Client Told It
MongoDB's record of who connected is a handshake document the client wrote itself, carrying an address that any Docker NAT or Kubernetes node already rewrote. Covers appName, client metadata, currentOp, ss and lsof for socket ownership, and reading the sending pid off the socket with mongosnoop and yeet.
MongoDBeBPFlinuxprocess-attributioncontainersuprobesobservabilityyeet
Read more →