<story><title>Using eBPF and predefined inspections to minimize “observability tax”</title><url>https://coroot.com/blog/minimizing-observability-tax</url></story><parent_chain></parent_chain><comment><author>ekiauhce</author><text>Thanks for the great article!&lt;p&gt;At my current employer we have a company-wide service for aggregating error logs in particular (WARN, ERORR level log rows and stacktraces, if it was an exception) so developers can analyze them for debugging purposes. Also it automatically gathers information about incoming http request (geo, ip address, user agent, etc) and you can easily see a particular segment of errors, and what kind of users getting them.&lt;p&gt;As I can see you have logs quantitative metric &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;community-demo.coroot.com&amp;#x2F;p&amp;#x2F;oc1vhnmq&amp;#x2F;app&amp;#x2F;default:Deployment:cart&amp;#x2F;Logs&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;community-demo.coroot.com&amp;#x2F;p&amp;#x2F;oc1vhnmq&amp;#x2F;app&amp;#x2F;default:Dep...&lt;/a&gt; but without any detalization (maybe it works this way only for the demo app). I mean, it would be great to be able to inspect each ERROR event separately or to define custom SLO with alert for particular type of errors.&lt;p&gt;Another great feature we use a lot is historical data, so you can find patterns of error spikes on months scale and when it has gone after fix.&lt;p&gt;FYI this error-service I&amp;#x27;m talking about is built on top of the ClickHouse, so it&amp;#x27;s quite responsive regardless of the large volumes of data.&lt;p&gt;Another thing I want to mention is cron-like workload (or batch jobs, you name it). Is there any support or useful metrics for it?</text></comment>
<story><title>Using eBPF and predefined inspections to minimize “observability tax”</title><url>https://coroot.com/blog/minimizing-observability-tax</url></story><parent_chain></parent_chain><comment><author>john-tells-all</author><text>this looks really useful! For my business I want 1) high-res data about local CPU-memory-IO (e.g. - how can I speed up tests), and 2) summary sampling data from production, to detect weird bugs or attacks. eBPF might be able to solve both cases!</text></comment>