goebpf

goebpf attaches eBPF programs to Linux scheduler tracepoints (sched_switch, sched_wakeup, block I/O, syscalls, and network events) and turns raw kernel activity into a ranked table and a plain-English status line, live.

What it does

• monitor – live context-switch tracing with a STATUS line that’s always emitted, even when the system is healthy
• explain – plain-English interpretation of sleep stacks: what a process is waiting for, and whether that’s normal
• diagnose – a one-shot 30 second health check combining monitor and explain, with suggested mitigations
• compare – diff two saved JSON reports to see what changed after a config change
• --serve – a background HTTP server exposing Prometheus /metrics and a live /report endpoint in json, yaml, or text

Quick start

go generate ./...
./compile
sudo setcap "cap_bpf,cap_perfmon,cap_sys_resource=ep" ./goebpf
sudo ./goebpf monitor