How eBPF Enriches OTel–A slow SQL query caused by one user with a million rows.

The post argues that eBPF and OpenTelemetry are complementary observability tools: OpenTelemetry provides intentional application-level business context, while eBPF supplies always-on, code-free visibility into kernel and network activity that may reveal details absent from standard instrumentation. It describes groundcover’s eBPF-based Kubernetes sensor, which collects telemetry from system calls, probes, and network traffic, including request payloads and database bind parameters, while allowing in-cluster aggregation and sensitive-field filtering. In a featured example, a Postgres service experienced intermittent latency despite normal error rates and a seemingly reasonable parameterized query; OpenTelemetry exposed the query template but not the parameter value, whereas eBPF captured the responsible user ID and response data. Filtering that user substantially reduced high-percentile latency, and a saved agent investigation identified a hot shard containing roughly one million rows as the likely cause, recommending data archiving, pagination, cleanup, or rebalancing rather than an additional index. The post presents this as part of a broader series on failures involving database tables, index rebuilds, and service regressions, and suggests that eBPF-derived evidence can guide more targeted OpenTelemetry instrumentation and reusable automated investigations.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.