eBPF Q&A

Daily, source-grounded answers to recurring questions about eBPF, Linux observability, profiling, runtime extension, and security. Each answer ends with an anonymized summary of the wider technical discussion seen that day.

Questions may begin in public issues, mailing lists, forums, or technical chat communities. Before publication, we rewrite them to remove identities, private deployment details, and wording that could identify the original participant. The answer is then checked against public primary sources. One question is published each day; when part of the monitored window cannot be covered, the gap is reported honestly on the page instead of stopping publication, and no invented material is ever used to fill it.

Latest Answers

• Why does a generated BPF loader object get rejected when only subprograms or unloaded programs push the count past the cap, and how does the check move to the real loaded program count?
• Why does libbpf skip manual strategy programs during the initial object load, and how does the struct ops map init pass clobber a manual load strategy set via the API?
• Why does the iocost cgroup cost model file only switch the built-in model between auto and user coefficient sets, and how does a BPF struct ops cost model take over a device while that file stops selecting a model?
• Why does the BPF redirect neighbor helper trip a kernel BUG on a packet whose Ethernet header is short, and how does the fix read the true header length differently on the receive path than on the transmit path?
• Why do non-sleepable BPF fentry and fexit programs silently skip calls from another task on the same CPU, and why do the skipped calls show up as recursion misses?
• When a BPF binfmt-misc handler runs an exec in transparent mode, why do the process exe link, comm, and command line still describe the binary instead of the interpreter that actually runs?
• Why does a local embeddings model with no server and no token count declare expected gaps in its GenAI span attributes, and how do the gaps stay spec-conformant?
• Why does the OBI Collector receiver keep its own module and version line, and why does a plain go get update not discover the receiver at an RC tag?
• Why can an OpenTelemetry OBI metric stay in the store up to twice as long as its TTL, and does the Prometheus exporter drop the same label set on every scrape?
• Why do OBI HTTP spans carry high-cardinality names, and how does the OpenTelemetry semantic convention bound span name cardinality?
• When does a BPF LRU hash map evict an entry, and what changes when its LRU list is per-CPU instead of shared across CPUs?
• When a FUSE daemon lookup of the OBI trace context map returns an entry, is that entry the trace context of the current request, and when can the hit be stale?
• Why do FUSE daemon lookups in the OBI trace context map miss when the FUSE filesystem runs inside a PID namespace?
• How does OpenTelemetry eBPF instrumentation decide which language runtimes it can stamp a trace context on, and how do you verify that a FUSE daemon thread actually receives the inherited context?
• Why do eBPF kprobe string reads truncate long open and stat paths, and how do you read the full path?
• How can a FUSE userspace filesystem daemon inherit OpenTelemetry trace propagation by reading the OBI trace context map keyed by pid and tid?
• Why does a tracepoint eBPF program attached through the Cilium eBPF Go library fire only on CPU 0 on a new kernel, when the identical program logged system calls system-wide on older distributions?
• Why does Node.js GenAI instrumentation live in opentelemetry-js-contrib rather than a dedicated repository, and why is there no Node.js equivalent to the Python GenAI instrumentation repo?
• Why should the list of available agent skills in GenAI telemetry be a dedicated span attribute instead of a separate span or a span event, and why does the span duration model rule out the span form?
• Why should a GenAI instrumentation gate inference events on the log pipeline severity instead of a dedicated emit flag, and is logger enabled an opt-in or an opt-out control?
• Why does the OpenTelemetry GenAI metric catalog stop at engine-agnostic latency and token counts, and how does model-serving-signals close the model-serving and autoscaling gap?
• Why does a UMEM chunk size cap the largest packet in AF-XDP zero-copy mode, and how must the FILL ring be kept fed so the kernel does not silently drop ingress?
• Why should a drop decision for redundant packets stay in the kernel instead of escalating every retry to user space, and how should a busy BPF ring buffer be sized and watched?
• Why can a trace not show which skills an agent could choose from, and how does the new skill definitions attribute make that list visible?
• Why does Hubble attribute a flow to the wrong policy rule when two overlapping L3/L4 policy entries match, even though the BPF datapath enforces the correct one?
• Why does the OBI Kubernetes cache address environment variable get ignored when the Helm chart renders a Config v2 document, and where must the cache address be written instead?
• Why does a Cilium LoadBalancer frontend stay missing after the conflicting Service that owns a shared VIP port is deleted, and how should a controller recover it?
• Why does every HTTP/2 request after the first on a TLS connection fail HPACK decoding when captured with TLS uprobes, and how should a decoder keep per-connection state?
• Why does BPF hash map key iteration return keys in an order that looks random instead of insertion order?
• Why do BPF task iterators split between sleepable and non-sleepable programs, and which process views fall on each side?
• Why does a connect or accept probe miss a socket that changed owner through a file descriptor handoff?
• Why does a full BPF hash map reject new keys with E2BIG, while updating an existing key still succeed?
• Why does a BPF LPM-trie lookup return a less specific stored prefix, and how does the key prefixlen field decide which entry wins?
• Does deleting a key from a BPF hash map zero out the value memory, and can a reused slot still hold the old value bytes?
• Why do TLS-encrypted service-to-service traces not stitch together in zero-code eBPF tracing, and which component actually bridges the encrypted hop?
• For a Node.js service instrumented by OBI, why can't I just turn off the per-callback trace-context sentinel because the service doesn't use manual spans or log enrichment?
• How do you get observability out of a hosted agent harness when the agent loop runs in a vendor service rather than your process?
• Why does the OBI config migration from v1 to v2 refuse to write a file when some fields have no mapping, and what is the middle ground?
• Why does an injected Node.js agent from an eBPF tracer stay inside a process after the service is excluded, until a pod restart?
• Should GenAI agent spans nest each tool execution under the model call that requested it, or keep model calls and tool executions as siblings under one agent span?
• Why did enabling an eBPF tracer on a Node.js service triple p99 on the hot path when the eBPF probes are cheap?
• Can a BPF program safely read user-space memory that belongs to another process?
• Why can't a BPF program sleep or block, and what should you use instead in a non-sleepable context?
• Why does a kprobe on a function never fire when the compiler inlined it?
• When should I collect eBPF samples in a BPF ring buffer instead of a perf event array?
• Why can't SIGKILL stop a BPF program load after verification succeeds?
• What eBPF/kernel limitations should a process behavior reconstruction tool account for in its architecture?
• Which technical boundaries actually constrain malicious eBPF payloads in practice?
• Which failure scenarios are mandatory before a transient-TCP-recovery eBPF benchmark is meaningful?
• Why can the eBPF verifier lose a relationship that is true for the low 32 bits?
• Why can reverse-path filtering drop return traffic in an eBPF Kubernetes datapath?
• Why can't an eBPF program read bpf_tail_call()'s return value?
• Why are PID and TID insufficient to correlate concurrent TLS, HTTP/2, and SSE traffic?
• Why must releasing a BPF dynptr invalidate every derived slice and clone?
• Can an unprivileged container create its own BPF token?
• Why can a single compare-and-swap lose atomic min/max updates under contention?
• How can you start a sched_ext scheduler at boot without systemd?
• Why can a syscall-rewriting trampoline crash threads created by clone or clone3?
• Should an OpenTelemetry GenAI evaluation result carry a verifiable-evidence reference?
• Why can an unused OBI Prometheus endpoint keep growing memory?
• Should an OpenTelemetry metrics producer copy service identity into every data point?
• How can you tell whether an OpenTelemetry GenAI attribute is stable enough to depend on?
• Why can libbpf load a BPF object slowly on a host with many kernel modules?
• Does cgroup v2 cpu.max still limit CPU time under BPF extensible scheduling?
• Why can classic uprobe BPF programs crash preemptible kernels that use private BPF stacks?
• How should eBPF programs carry per-packet metadata across networking hooks?
• How should a Linux-VM eBPF backend support macOS and Windows without mislabeling host coverage?
• How should OpenInference coexist with OpenTelemetry's GenAI semantic conventions?
• Why can scxctl accept a scheduler switch while the service still does not start as intended?
• Why can inserting a socket into SOCKHASH from TC egress soft-lock the kernel?
• Why can a sched_ext scheduler fail until pahole is upgraded?
• Can eBPF detect secrets in network traffic without collecting them?