Observability: Agent vs eBPF

Observability: Agent vs eBPF A workflow diagram generated by Archify. 01 / eBPF way EX / Traditional · SDK/agent Application · no changes needed · eBPF way Application no changes needed Kernel eBPF · automatic instrumentation · eBPF way Kernel eBPF automatic instrumentation Monitoring · eBPF way Monitoring Application · code changes needed · Traditional · SDK/agent Application code changes needed SDK / agent · per-lang SDKs · Traditional · SDK/agent SDK / agent per-lang SDKs Metrics · Traditional · SDK/agent Metrics Monitoring · Traditional · SDK/agent Monitoring observes syscalls Legend Application Collection path eBPF instrumentation Backends

Cost of the agent way

  • • SDK integration per language and framework
  • • Instrumentation maintained per deployment

What eBPF wins

  • • Observes every process at once from the kernel
  • • Applied without redeploying applications