A Practical Linux Log-Checking Workflow That Works
Start with the current boot, then narrow failures by service, time, kernel, app, or container using journalctl, dmesg, and /var/log without drowning in noise.
Tag: System Monitoring
Use eBPF to Trace VPN Traffic Across Encryption
The right eBPF hooks expose plaintext on tun0 or wg0 and ciphertext on the NIC, with practical guidance on correlation, probes, and failure diagnosis.
OpenWrt Traffic Monitor: Read Raw Kernel Data First
Skip dashboards for unreliable counts. Start with /proc/net/dev and tc qdisc, then layer nlbwmon for per-IP accountability on OpenWrt routers.
Create eBPF IDS on Linux
I will walk you through a working eBPF IDS Linux setup that hooks kernel events, streams signals to user space, and keeps performance predictable. I start from how the verifier and JIT work in the linux kernel so you can pick the right attach points. I explain kprobes, tracepoints, uprobes, XDP, and LSM in plain […]
Mount Bpffs at /Sys/fs/bpf: CAP_SYS_ADMIN and Persistence
bpffs mount requires CAP_SYS_ADMIN for both the mount and bpf() syscall. Learn how to diagnose failures, make mounts persistent, and secure pins across reboots.
Linux Kernel Updates Without Reboot: Live Patch vs Reboot
Live patching fixes CVEs in place without rebooting, but kernel version upgrades need kexec or a restart. Learn which tool solves your actual problem.
Tracepath on Debian: No-Root MTU Discovery Guide
tracepath finds broken routes and shrinking packet sizes without root access on Debian. Install from iputils-tracepath, run in seconds, skip the sudo hassle.
5 Best PoE Switches for Home Labs: TP-Link Tops Our Picks
TP-Link SG2210XMP-M2 leads our tested PoE switches for homelabs, offering 2.5G ports and 10G uplinks. Compare fanless options with real PoE budgets.
What Kernel Times Mean and How to Fix Them
Kernel times show OS overhead on your CPU. Learn what drives them high, how to spot driver problems in Task Manager, and the tools to diagnose the real culprit.
How Nlbwmon Maps OpenWrt Traffic to Devices
luci-app-nlbwmon attributes OpenWrt traffic to IP and MAC addresses, explains apk versus opkg installs, and helps troubleshoot missing or misleading totals.
BCC eBPF Compiler for Linux Kernel Tracing
BCC compiles eBPF C at runtime for deep Linux kernel tracing. Learn when to use BCC versus CO-RE, which tools solve real problems, and how to write safe probes.
How Pixie Uses eBPF for Kubernetes Visibility
Pixie uses eBPF to expose Kubernetes HTTP, gRPC, TLS, database, and network telemetry without code changes, while showing where kernel-level visibility ends.
Operationalizing Falco: eBPF Driver Setup and Alert Routing
Falco requires modern eBPF drivers, DaemonSet deployment, rule tuning, and Falcosidekick integration to catch runtime threats in production clusters.