# Tuxscope: Linux Kernel Observability with eBPF

> Learn the Linux kernel by watching it: eleven cumulative eBPF labs in Rust, from syscall tracing to container visibility and CO-RE.

- Source: https://stevenfoerster.com/tutorials/paths/tuxscope/

Learning Path

Learn how your Linux kernel works by watching it: eleven cumulative labs that build a single eBPF-powered observability tool in Rust, from syscall tracing to container-level visibility and portable CO-RE.

7 available [Start the path](https://stevenfoerster.com/tutorials/tuxscope-hello-ebpf/)

1.  - 1
    - intermediate

    ## [Tuxscope Lab 1: Hello eBPF](https://stevenfoerster.com/tutorials/tuxscope-hello-ebpf/)

    Build your first eBPF program in Rust, trace write syscalls and stream events from kernel space to userspace with PerfEventArray.

2.  - 2
    - beginner

    ## [Tuxscope Lab 2: Syscall Tracing](https://stevenfoerster.com/tutorials/tuxscope-syscall-tracing/)

    Trace all system calls in real time, capture syscall IDs from raw\_syscalls/sys\_enter, resolve them to names, and switch from PerfEventArray to RingBuf.

3.  - 3
    - intermediate

    ## [Tuxscope Lab 3: File I/O Observation](https://stevenfoerster.com/tutorials/tuxscope-file-io-observation/)

    Probe the VFS layer with kprobes on vfs\_read and vfs\_write to observe per-process file I/O volume in real time.

4.  - 4
    - intermediate

    ## [Tuxscope Lab 4: Network Monitoring](https://stevenfoerster.com/tutorials/tuxscope-network-monitoring/)

    Monitor TCP connections in real time by probing tcp\_v4\_connect and inet\_csk\_accept, capture source and destination IPs, ports, and connection direction.

5.  - 5
    - intermediate

    ## [Tuxscope Lab 5: Tracing Process Lifecycle with eBPF](https://stevenfoerster.com/tutorials/tuxscope-process-lifecycle/)

    Trace fork, exec, and exit events in real time to understand how Linux creates, transforms, and destroys processes.

6.  - 6
    - intermediate

    ## [Tuxscope Lab 6: Observing Memory with Page Fault Tracing](https://stevenfoerster.com/tutorials/tuxscope-memory-observation/)

    Trace page faults and OOM kills to understand how Linux implements virtual memory through demand paging.

7.  - 7
    - intermediate

    ## [Tuxscope Lab 7: Profiling Disk I/O Latency with eBPF HashMaps](https://stevenfoerster.com/tutorials/tuxscope-disk-io-profiling/)

    Use eBPF HashMap state to trace the block layer and measure per-request I/O latency from issue to completion.


[All tutorials and learning paths](https://stevenfoerster.com/tutorials/)