eBPF Instrumentation for APM in ObserveOps
ObserveOps (formerly known as AIOps) supports eBPF-based instrumentation for APM tracing. eBPF uses kernel-level technology to automatically ingests trace for the running applications with no code changes, no APM library installation, and no application restart required. Once you enable eBPF on the agent, ObserveOps discovers and instruments services automatically.
Prerequisites
Agent Requirements
- The Motadata agent version must be 8.2.6 or higher.
- Agent operating system is Linux.
- A Motadata agent is installed on the host and shows as Running in Settings > Monitor (Agent) Settings.
Trace should be enabled on the agent using Monitor Settings > Grid > Action icon > Enable Trace. If Trace is disabled, eBPF cannot be enabled.
Host and Kernel Requirements
- CPU architecture: amd64
- Linux kernel: 5.8 or newer or RHEL-family Linux 4.18 or newer that includes the required eBPF backports
- Kernel has BTF (BPF Type Format) support
- Root privileges are available to run the eBPF agent
Supported Languages
| Language | Version |
|---|---|
| Java | 8 or higher |
| .NET | Any |
| PHP | Any |
| Node.js | 8.0 or higher |
| Python | 3.9 or higher |
| Go | 1.17 or higher |
| C++ | Any |
| Ruby | 3.0.2 or higher |
How It Works
eBPF instrumentation attaches probes at the Linux kernel level. These probes observe running applications without modifying their code or restarting them. Once you enable eBPF on the agent, ObserveOps automatically discovers services running on that host and refreshes the discovered services list approximately every 5 seconds.
This makes eBPF the lowest-disruption way to start collecting APM traces especially for production hosts where restarting services may not be feasible.
Once you enable eBPF on the agent, the discovered services gets instrumented automatically.
Step 1: Enable eBPF on the Agent
Enable eBPF on the agent before you register any application.
- Go to Settings → Monitor (Agent) Settings.
- Locate the agent in the list and open its action menu (⋯).
- Click eBPF Enable.
- Confirm the prompt — the agent restarts to apply the configuration change.
The eBPF Enable action appears only when the agent is Linux, has APM Trace enabled, and is version 8.2.6 or higher. If you don't see this option, check those three conditions first.
Disable eBPF
To turn eBPF off, select eBPF Disable from the same action menu on the agent.
If you disable APM Trace on an agent that has eBPF enabled, eBPF is automatically disabled as well. The confirmation dialog warns: "Note: eBPF is enabled and will also be disabled." Re-enable Trace first before re-enabling eBPF.
Step 2 — Register an Application Using eBPF
- Go to Settings → APM Settings → Application Registration.
- Open the Register Application drawer.
- Set Deployment Type to Host/VM.
- Under Instrumentation Method, select eBPF.
- Select the Agent running on the target host.
- The Discovered Services grid populates automatically. No setup command and no application restart are needed — ObserveOps instruments the running applications in place.
- Click Configure on a discovered service. The Register Discovered Service panel opens showing the auto-detected Service Name and Language — both are read-only.
- Click Register Service. The service appears in the APM application list and begins reporting traces.
The Configure button is disabled for a service that is already registered, has a duplicate service name, or is detected as an unknown_service.
Example
Your operations team runs a Java payment service and a Python notification service on a Linux production host. Adding APM agents would require coordinated restarts across both services. Instead, you enable eBPF on the Motadata agent installed on that host. Within seconds, both services appear in the Discovered Services grid. You click Configure and register each service — no code changes, no restarts, no setup commands.
Troubleshooting
| Symptom | Likely Cause | Fix |
|---|---|---|
| Discovery grid never appears — message "Please enable eBPF from Agent Monitor Settings" | eBPF not enabled on the selected agent | Enable eBPF on the agent (Step 1), then return to registration |
| eBPF Enable/Disable action missing from the agent menu | Agent is not Linux, APM Trace is off, or agent is below 8.2.6 | Use a Linux agent, enable APM Trace first, and upgrade the agent to 8.2.6 or higher |
| Message: "…doesn't support eBPF instrumentation. Please upgrade the agent to version 8.2.6 or greater…" | Agent below the minimum version | Upgrade the agent to 8.2.6 or higher |
| eBPF won't enable or no traces appear | Host kernel prerequisites not met — kernel below 5.8 without backports, missing BTF, or non-amd64 CPU | Verify kernel version (5.8+ or RHEL 4.18+ with backports), BTF support, amd64 architecture, and root privileges |
| eBPF turned itself off | APM Trace was disabled on the agent | Re-enable Trace, then re-enable eBPF |
| Discovery grid stays empty with no error | Application not running on the host, or language is not supported | Confirm the application is running and check the supported languages list above |
| Configure button disabled on a service | Already registered, duplicate name, or unknown_service detected | Check the APM application list and rename or disambiguate the service if needed |
| eBPF option not shown in the registration drawer | Deployment type is Docker or Kubernetes, or OS is Windows | eBPF supports Host/VM on Linux only — select Host/VM, or use the Docker/Kubernetes flow |
Known Limitations
- eBPF instrumentation is available for Host/VM deployments on Linux only. Windows, Docker, and Kubernetes deployments are not supported.
- CPU architecture must be amd64 — other architectures are not supported.
- APM Trace must be enabled on the agent. Disabling Trace automatically disables eBPF.
- Service Name and Language at registration are auto-detected and read-only — custom parameters, service attributes, and business service assignment are not applicable to eBPF registration.
- Enabling or disabling eBPF on the agent requires an agent restart. Instrumenting applications after eBPF is enabled does not require a restart.
- Minimum agent version required is 8.2.6.
Quick Reference
| Setting | Value |
|---|---|
| Minimum agent version | 8.2.6 |
| OS support | Linux only |
| Deployment type | Host/VM only |
| CPU architecture | amd64 |
| APM Trace dependency | Must be enabled — disabling Trace disables eBPF |
| Application restart | Not required to instrument — required only when enabling or disabling eBPF on the agent |
| Setup command on host | None |
| Discovery refresh | Approximately every 5 seconds |