Linux kernel evidence · One Sensor architecture
Connect Linux processes, services and containers to the endpoints they communicate with. AmrudAi collects bounded kernel-level socket evidence through the local Linux Agent and brings it into Infrastructure Sensor collection, temporal topology and the Investigation Workbench—without application code changes or an application SDK.
The application experience
See the complete workspace. Enlarge any image to inspect its panels, navigation and evidence at actual size.
eBPF kernel observability
AmrudAi observes supported Linux process and socket behavior without application code changes or an application SDK. The Linux Agent collects the evidence on the monitored host and brings it into the unified Sensor architecture.
Supported socket-related probes observe connection lifecycle, transport timing and counters.
Add process, service and container identity; aggregate within explicit resource and cardinality limits.
Receive the host evidence through its assigned collection path and retain delivery and source-quality context.
Correlate the evidence with topology, Flow, logs, metrics, changes and service checks.
Kernel compatibility, available attach points and operating-system permissions determine the effective collection profile. Supported tracepoints or kprobe-style hooks observe socket-related events. Kernel verification and the Agent collection policy govern program loading and operation.
Executable, service, container, cgroup and network-namespace context connect transport activity to the workload. Stable selectors preserve continuity across restarts and changing replicas, with current PIDs retained as runtime evidence.
Evidence that connects infrastructure and network teams
Transport metadata gains operational meaning when it is evaluated beside the host, application prerequisites and dependency path.
Designed around the monitored workload
The host exists to run the customer workload. AmrudAi uses bounded collection and local aggregation to keep diagnostic depth proportionate to the operating environment.
Technical background: Linux eBPF verifier , libbpf and BPF ring buffers .
The capability in detail
Observe connection lifecycle, establishment failures, active sockets, throughput, TCP round-trip time and retransmissions on supported Linux kernels. Relate the transport symptom to the process, service or container responsible for the connection.
The Linux Agent attaches the supported kernel probes on the monitored host. It aggregates evidence locally and forwards it through the assigned Infrastructure Sensor, using the same durable collection and Core investigation path as host telemetry.
Enable supported kernel collection without adding tracing SDKs, editing application source or rebuilding the application. Compatibility and privilege checks identify the collection capabilities available on each host.
Retain executable, service, container, cgroup and network-namespace context where available. Current PIDs remain runtime evidence; stable workload selectors preserve continuity through process restarts and changing replicas.
Compare retransmissions, connection failures, resets and round-trip time with supported TCP and host counters. Receive-window pressure and socket-state evidence help investigate a slow consumer or transport path while retaining each signal's source and availability.
Place process socket behavior beside DNS resolution tests, TLS handshake and certificate checks, and operational logs. This connects a transport failure to the relevant service prerequisite while preserving the distinction between kernel metadata and application or synthetic evidence.
Map pod and workload communication to remote services and node context. Correlate changing replicas, resource pressure, retransmissions and connection failures without losing the incident-time dependency relationship.
Kernel maps, event buffers and local aggregation use explicit capacity and resource limits. The collector reports sampled, shed or dropped evidence and resource-guarded operation so a busy collector does not create a misleading picture of the workload.
The process-network stream carries identities, endpoints, counters and timing. It avoids application payload collection, TLS decryption, process-memory inspection and environment-variable collection, reducing sensitive data exposure while retaining useful transport evidence.
Join host socket evidence with active paths, Flow, network configuration, database state and service checks. A healthy database listener plus failed connections from one path can redirect the investigation toward transit or policy instead of an unnecessary database restart.
From information to action
Verify the host's kernel, BTF/CO-RE requirements, permitted capabilities and effective collection policy.
Collect socket events into bounded process, service, endpoint and protocol summaries with explicit quality and resource accounting.
Move the evidence through the Agent and Sensor durable path, then join it to temporal topology, Flow, logs, metrics and changes.
Select the affected connection in the Workbench, compare independent evidence and validate the service after the operational action.
Linux visibility designed around the workload
Use eBPF where the host supports the required kernel interfaces and operating policy. Collection state and evidence completeness remain visible alongside the result.
Connect the workflow
Kernel-level eBPF evidence is collected by the Linux Agent running on that host. The assigned Infrastructure Sensor receives and forwards the evidence. Agentless infrastructure checks remain available through their supported remote interfaces, with their own coverage and privilege requirements.
Supported process-network collection requires no application code changes or application SDK. The host still needs the compatible kernel interfaces, the local Agent and the required operating-system permissions.
It bounds kernel maps, buffers, aggregation cardinality and Agent resources, and summarizes evidence locally before forwarding it. Actual resource use depends on the kernel, workload, event rate and policy; the deployment's measured profile determines the operating limits.
The kernel process-network stream collects transport metadata and counters. It does not decrypt TLS or collect application payloads. DNS, TLS, application and database evidence can join the same investigation through their respective supported checks and connectors.
The collector reports its resource-guarded or partial state, including shed and drop counters. Base host monitoring continues, and RCA treats the missing detail as reduced evidence coverage rather than proof that the host or service failed.
Explore the technology, service dependencies and operating requirements that matter to your team.
Search the complete website · Esc to close · Tab to navigate results