eBPF Instrumentation for APM in ObserveOps
ObserveOps supports eBPF-based instrumentation for APM tracing on Host/VM and Docker deployments. eBPF uses kernel-level technology to automatically ingest traces for the running applications with no code changes, no APM library installation, and no application restart required. Once you enable eBPF on the Motadata Agent, ObserveOps discovers and instruments services applying one click service instrumentation step — this applies to applications running directly on the host and to applications running inside containers on that host.
Prerequisites
Agent Requirements
- The Motadata agent version must be 10.0.0 or higher.
- Agent operating system is Linux.
- A Motadata agent is installed on the host and shows as Running in Settings > Monitor (Agent) Settings.
- Before enabling eBPF in the agent, ensure the following configuration is set:
"ebpf.agent.status" : "no",.
Trace should be enabled on the agent using Monitor Settings > Grid > Action icon > Enable Trace. If Trace is disabled, eBPF cannot be enabled.
Host and Kernel Requirements
- CPU architecture: amd64
- Linux kernel: 5.8 or newer or RHEL-family Linux 4.18 or newer that includes the required eBPF backports. To check the kernel version use the
uname -rcommand. - Kernel has BTF (BPF Type Format) support
- Root privileges are available to run the eBPF agent
Supported Languages
| Language | Version |
|---|---|
| Java | 8 or higher |
| .NET | Any |
| PHP | Any |
| Node.js | 8.0 or higher |
| Python | 3.9 or higher |
| Go | 1.17 or higher |
| C++ | Any |
| Ruby | 3.0.2 or higher |
How It Works
eBPF instrumentation attaches probes at the Linux kernel level. These probes observe running applications without modifying their code or restarting them. Once you enable eBPF on the agent, ObserveOps automatically discovers services running on that host and refreshes the discovered services list approximately every 5 seconds.
This makes eBPF the lowest-disruption way to start collecting APM traces especially for production hosts where restarting services may not be feasible.
Once you enable eBPF on the agent, the discovered services gets instrumented automatically.
Step 1: Enable eBPF on the Agent
Enable eBPF on the agent before you register any application.
- Go to Settings → Monitor (Agent) Settings.
- Locate the agent in the list and open its action menu (⋯).
- Click eBPF Enable.
- Confirm the prompt — the agent restarts to apply the configuration change.
The eBPF Enable action appears only when the agent is Linux, has APM Trace enabled, and is version 8.2.6 or higher. If you don't see this option, check those three conditions first.
Disable eBPF
To turn eBPF off, select eBPF Disable from the same action menu on the agent.
If you disable APM Trace on an agent that has eBPF enabled, eBPF is automatically disabled as well. The confirmation dialog warns: "Note: eBPF is enabled and will also be disabled." Re-enable Trace first before re-enabling eBPF.
Step 2 — Register an Application Using eBPF
- Go to Settings → APM Settings → Application Registration.
- Open the Register Application drawer.
- Set Deployment Type to Host/VM.
- Under Instrumentation Method, select eBPF.
- Select the Agent running on the target host.
- The Discovered Services grid populates automatically. No setup command and no application restart are needed — ObserveOps instruments the running applications in place.
- Click Configure on a discovered service. The Register Discovered Service panel opens showing the auto-detected Service Name and Language — both are read-only.
- Click Register Service. The service appears in the APM application list and begins reporting traces.
The Configure button is disabled for a service that is already registered, has a duplicate service name, or is detected as an unknown_service.
Example
Your operations team runs a Java payment service and a Python notification service on a Linux production host. Adding APM agents would require coordinated restarts across both services. Instead, you enable eBPF on the Motadata agent installed on that host. Within seconds, both services appear in the Discovered Services grid. You click Configure and register each service — no code changes, no restarts, no setup commands.
Quick Reference
| Setting | Value |
|---|---|
| OS support | Linux only |
| Deployment type | Host/VM and Docker |
| CPU architecture | amd64 |
| APM Trace dependency | Must be enabled — disabling Trace disables eBPF |
| Application restart | Not required to instrument — required only when enabling or disabling eBPF on the agent |
| Setup command on host | None |
| Discovery refresh | Approximately every 5 seconds |