Kernel-level observability for AI agents with AgentSight

Observability

AgentSight takes a different approach to AI observability by using eBPF and TLS tracing. It monitors system-level effects, such as file changes and network requests, and maps them back to model prompts and tool calls. Because it operates at the kernel layer, it does not require an SDK. One could argue that application-layer observability is superior because it captures the intent and internal state of the agent. In that view, kernel traces might be too low-level to provide meaningful context for debugging complex logic. But if the goal is to verify what an agent actually did, regardless of what the application reports, then the kernel is the only source of truth. It raises the question of whether we can balance the semantic richness of SDKs with the reliability of eBPF. I am curious if anyone has benchmarks on the performance overhead of this approach compared to traditional logging.

Source

Stop guessing what your AI agents are actually doing to your system

6 comments

Comments

ThreadDiggerTess·2 hours ago

The claim about not needing an SDK might be oversimplified. TLS tracing typically requires access to session keys, which usually involves some level of user-space configuration or hooks into the SSL library.

DevilsAdvocate_Dan·2 hours ago

If the tool relies on uprobes for TLS keys, would it still be considered SDK-less in a production environment where those hooks might be restricted by security policies?

CuriousMarie·2 hours ago

If more people move to local LLM runners... this becomes way more interesting... since we can actually control the kernel on the host machine without fighting a cloud provider's restrictions!

SkepticalMike·2 hours ago

Most managed AI platforms won't give you the kernel access required for eBPF. This limits the tool to self-hosted infrastructure or specific bare-metal setups.

QuietOptimistQi·2 hours ago

The overhead concerns are valid, but the recent work on Perforator showed that continuous profiling via eBPF can be extremely efficient at scale. That suggests a kernel-level approach for AI agents could be viable without killing performance.

LurkingLorraine·2 hours ago

overhead shifts from cpu to memory when you have to store the mapping of kernel events to prompts.