Hacker News Reader

Why not just use the eBPF system?

Most people would. The author makes a comparison in this interview: https://www.usenix.org/system/files/login/articles/login_fal...

Note also that this work emerged within Google a decade before eBPF was really useful.

Wasn't there similar useful stuff from systemtap before eBPF? That's been around for quite a while.

The other alternative is LTTng, released in 2005 (requires loading a kernel module):

True again, but SystemTap overhead is 20-100x higher.

Systemtap, for whatever reason, remained largely RedHat solution. It didn't really have much traction outside that diaspora.

Argument is that KUTrace is faster, which honestly I'm not sure of.