Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
How to Find Slow MongoDB Queries on Linux in 2026: The Slow Query Is Often Two Hundred Fast Ones
A slow-query log grades one query at a time, so an endpoint that issues two hundred fast queries produces an empty profiler and a 900ms response. Covers query shapes and N+1 detection, the profiler's 100ms threshold, Atlas Query Profiler, explain, mongotail, and reading the commands at the socket with mongosnoop and yeet.
How to Find Which Process Is Querying MongoDB on Linux in 2026: The Server Only Knows What the Client Told It
MongoDB's record of who connected is a handshake document the client wrote itself, carrying an address that any Docker NAT or Kubernetes node already rewrote. Covers appName, client metadata, currentOp, ss and lsof for socket ownership, and reading the sending pid off the socket with mongosnoop and yeet.
SQLite Has No Query Log. That's a Library Problem, Not a Logging Problem (2026)
SQLite has no server, so there is no daemon holding a log you could tail. The ecosystem answered that with sqlite3_trace_v2 and ORM echo flags, which are per-connection and need the app's cooperation. The shared libsqlite3 is a better place to stand, and here is what it costs you.
bpftrace vs BCC in 2026: Which One to Start Your eBPF Project With
Start with bpftrace unless your project already needs flags, floating-point math, or hosts with no compiler on them, in which case start with BCC. A side-by-side review of what each one installs, what each one refuses to do, the 512-byte stack limit that ends a bpftrace script, and how to tell today which one you will outgrow.
Top 5 Kernel Metrics Your APM Agent Misses in 2026: Ranked by How Often They End the Investigation
Five questions Datadog, Pixie, Coroot and node_exporter structurally cannot answer, ranked: off-CPU time, TCP retransmit attribution, per-disk latency histograms, runqueue delay, and the gap between what your app asked for and what reached the device. Each with the tool that gets it and what it costs to run.
How to Audit What an AI Coding Agent Actually Ran on Linux in 2026: The Log Stops Where the Shell Begins
Claude Code, Codex and Cursor all log their tool calls, and Anthropic documents the boundary in its own docs: OTEL_* is never passed to the subprocesses the Bash tool spawns. Compare what OpenTelemetry, an MCP gateway, auditd, strace and a kernel probe each record when an agent runs a shell one-liner, and see which one can name the commands underneath it.
Why Is My Redis Slow in 2026? How to See What Your App Is Actually Sending
Redis latency has two shapes: the server is blocked, or your app is asking too much. Slowlog, INFO commandstats and redis-cli --latency answer the first. None of them tell you which key pattern is eating your traffic or which process sent it. Here is how to read the traffic itself, live, with redissnoop and yeet.
Traversal vs yeet: An AI SRE Reasons Over Your Telemetry, It Doesn't Collect It
Traversal's AI SRE runs causal search over the observability stack you already have, so its ceiling is what your instrumentation recorded; yeet is a JavaScript runtime for Linux ops that loads an eBPF probe for one missing fact while the incident is open. Which order to use them in, and how to test it against your own postmortems.
How to Monitor HTTP Traffic on Linux in 2026: What the Kernel Sees That Your Proxy Doesn't
A sidecar proxy sees the traffic you routed through it. The kernel's TC layer sees what actually crossed the wire, including loopback, without anything being rerouted. Compares OpenTelemetry, Envoy, tcpdump, Pixie, Cilium Hubble and httpwatch, and how to pick the one that answers your question.
How to Capture 802.11 Frames on a Connected Interface on Linux: Your Radio Already Hears Them
Monitor mode drops the association you are trying to diagnose, so airodump-ng and Kismet cannot watch the link you are standing on; airtop attaches eBPF fentry programs to mac80211 and cfg80211 to read 802.11 frames, RSSI in dBm and deauth counts on a normal connected Linux interface.
How to Monitor HTTP Traffic on Linux in 2026: Why the Kernel Sees What Your Access Log Doesn't
How to see the HTTP requests crossing a Linux host, including the ones your access log never records because they never reached a handler. Covers eBPF capture at the kernel's TC layer, tcpdump, Coroot, Pixie, Cilium Hubble, a proxy and OpenTelemetry, with the commands to run and the kernel version each one needs.