eBPF Instrumentation for APM in ObserveOps

ObserveOps supports eBPF-based instrumentation for APM tracing on Host/VM, Docker, and Kubernetes deployments. eBPF uses kernel-level technology to automatically ingest traces for the running applications with no code changes, no APM library installation, and no application restart required. Once you enable eBPF on the Motadata Agent (Host/VM, Docker) or on the Motadata APM Agent DaemonSet (Kubernetes), ObserveOps discovers and instruments services applying one click service instrumentation step. This applies to applications running directly on the host, inside containers on that host, or inside pods on a Kubernetes node.

Prerequisites

Agent Requirements

• The Motadata agent version must be 10.0.0 or higher.
• Agent operating system is Linux.
• A Motadata agent is installed on the host and shows as Running in Settings > Monitor (Agent) Settings.
• Before enabling eBPF in the agent, ensure the following configuration is set: "ebpf.agent.status" : "no",.

info

Trace should be enabled on the agent using Monitor Settings > Grid > Action icon > Enable Trace. If Trace is disabled, eBPF cannot be enabled.

Host and Kernel Requirements

• CPU architecture: amd64
• Linux kernel: 5.8 or newer or RHEL-family Linux 4.18 or newer that includes the required eBPF backports. To check the kernel version use the uname -r command.
• Kernel has BTF (BPF Type Format) support
• Root privileges are available to run the eBPF agent

Supported Languages

Language	Version
Java	8 or higher
.NET	Any
PHP	Any
Node.js	8.0 or higher
Python	3.9 or higher
Go	1.17 or higher
C++	Any
Ruby	3.0.2 or higher

How It Works

eBPF instrumentation attaches probes at the Linux kernel level. These probes observe running applications without modifying their code or restarting them. Once you enable eBPF on the agent, ObserveOps automatically discovers services running on that host and refreshes the discovered services list approximately every 5 seconds.

This makes eBPF the lowest-disruption way to start collecting APM traces especially for production hosts where restarting services may not be feasible.

info

Once you enable eBPF on the agent, the discovered services gets instrumented automatically.

Step 1: Enable eBPF on the Agent

Enable eBPF on the agent before you register any application.

1. Go to Settings → Monitor (Agent) Settings.
2. Locate the agent in the list and open its action menu (⋯).
3. Click eBPF Enable.
4. Confirm the prompt — the agent restarts to apply the configuration change.

note

The eBPF Enable action appears only when the agent is Linux, has APM Trace enabled, and is version 10.0.0 or higher. If you don't see this option, check those three conditions first.

Disable eBPF

To turn eBPF off, select eBPF Disable from the same action menu on the agent.

note

If you disable APM Trace on an agent that has eBPF enabled, eBPF is automatically disabled as well. The confirmation dialog warns: "Note: eBPF is enabled and will also be disabled." Re-enable Trace first before re-enabling eBPF.

Step 2 — Register an Application Using eBPF

1. Go to Settings → APM Settings → Application Registration.
2. Open the Register Application drawer.
3. Set Deployment Type to Host/VM.
4. Under Instrumentation Method, select eBPF.
5. Select the Agent running on the target host.
6. The Discovered Services grid populates automatically. No setup command and no application restart are needed — ObserveOps instruments the running applications in place.
7. Click Configure on a discovered service. This opens a right-side drawer titled Register Discovered Service, which carries the auto-detected Service Name and Language (both read-only).

Follow the registration steps from the right-side drawer and click the Save button.

Before clicking Save, you can scroll to the Notify section and tick Enable trace notifications to receive a notification when this service stops sending traces for the configured time window.

Once saved, the service appears in the APM application list and begins reporting traces.

note

The Configure button is disabled for a service that is already registered, has a duplicate service name, or is detected as an unknown_service.

Example

Your operations team runs a Java payment service and a Python notification service on a Linux production host. Adding APM agents would require coordinated restarts across both services. Instead, you enable eBPF on the Motadata agent installed on that host. Within seconds, both services appear in the Discovered Services grid. You click Configure and register each service — no code changes, no restarts, no setup commands.

Kubernetes Deployment

eBPF ships as a DaemonSet component of the existing Kubernetes APM agent Helm chart. One DaemonSet runs per node, attaches eBPF probes at the node kernel, and surfaces discovered services across every pod on that node for registration from the APM onboarding wizard.

Prerequisites (Kubernetes)

• Kubernetes nodes meet the same kernel + CPU prerequisites as the Host/VM path (Linux kernel 5.8 or newer with BTF support, amd64).
• Helm 3.9 or higher and Kubernetes v1.24 or higher on the target cluster.
• The Motadata APM Agent Helm chart is installed in the motadata-operator-np namespace.
• Nodes run a container runtime with eBPF support (containerd, CRI-O, or Docker Engine on a Linux kernel that supports eBPF).

Enable eBPF From the APM Onboarding Wizard

1. Go to Settings → APM → Application Registration and open the registration drawer.
2. Pick Kubernetes on the left pane.
3. Under Instrumentation Method, select eBPF.
4. Pick the Deployment Type (Kubernetes, OpenShift, EKS, OKE, GKE, Rancher, AKS).
5. Pick the Cluster Name (existing or new).
6. Run the generated Helm command on your cluster. The command adds the eBPF DaemonSet to the existing motadata-k8s chart and enables it per-node.
7. Return to the drawer. The Discovered Services grid populates with services detected across all nodes.
8. Click Configure on a service and Register Service.

Enable eBPF Through Helm Values Directly

For GitOps or scripted installs, set the eBPF enable flag directly on the existing Helm command:

helm upgrade --install motadata motadata-charts/motadata-k8s \
  --namespace motadata-operator-np \
  --set motadata-apm-agent.ebpf.enabled=true \
  --set motadata-apm-agent.env.clusterName='{your-cluster}' \
  --set motadata-apm-agent.env.motadataServerUrl=http://{observeops-server}:4318/kubernetes/cluster

The eBPF DaemonSet comes up on every node in the cluster. Discovery refreshes approximately every 5 seconds per node.

note

Nodes that do not meet the kernel or BTF requirements remain uninstrumented. The DaemonSet pod on those nodes logs a prerequisite error, but the rest of the cluster continues to collect traces normally.

Quick Reference

Setting	Value
OS support	Linux only
Deployment type	Host/VM, Docker, and Kubernetes
CPU architecture	amd64
APM Trace dependency	Must be enabled on Host/VM and Docker; implicitly enabled on Kubernetes via the APM agent chart
Application restart	Not required to instrument. Required only when enabling or disabling eBPF on a Host/VM or Docker agent
Setup command on host	None on Host/VM and Docker. One Helm command for Kubernetes
Discovery refresh	Approximately every 5 seconds

Related Topics

• APM Overview
• View and Analyze Traces
• Java Agent Instrumentation
• Kubernetes APM
• Auto Instrumentation