eBPF + LLM: Building the Infrastructure for Observability Agents

The talk “eBPF + LLM: Building the Infrastructure for Observability Agents” explains how eBPF provides zero‑intrusion, Full Stack data collection for high‑quality observability signals, and how large language models (LLM) turn that data into efficient AI‑driven agents.

Traditional APM suffers from incomplete coverage and data‑quality issues; eBPF solves these by hooking kernel, system, network and application functions without code changes ( Zero Code ), delivering raw events such as Process, File, Perf, Socket, Kernel and Hardware.

DeepFlow processes raw eBPF data into business‑level metrics, service maps, distributed traces and performance flame graphs, and enriches them with unified tags from K8s, Cloud and CMDB.

By combining eBPF data with LLM capabilities (prompt engineering, RAG, fine‑tuning), DeepFlow’s AI Agent can automate ticket handling, change‑impact analysis and vulnerability triage, dramatically reducing resolution time; the metaphorical phrase " Whos your daddy " is used to illustrate eBPF’s foundational role.

The solution has been validated in a peer‑reviewed ACM SIGCOMM paper and is available as open‑source on GitHub, with community and enterprise editions supporting Grafana plugins and multiple LLM back‑ends.