Learning Path

Tuxscope: Linux Kernel Observability with eBPF

Learn how your Linux kernel works by watching it: eleven cumulative labs that build a single eBPF-powered observability tool in Rust, from syscall tracing to container-level visibility and portable CO-RE.

7 available Start the path
  1. 1 intermediate

    Tuxscope Lab 1: Hello eBPF

    Build your first eBPF program in Rust, trace write syscalls and stream events from kernel space to userspace with PerfEventArray.

  2. 2 beginner

    Tuxscope Lab 2: Syscall Tracing

    Trace all system calls in real time, capture syscall IDs from raw_syscalls/sys_enter, resolve them to names, and switch from PerfEventArray to RingBuf.

  3. 3 intermediate

    Tuxscope Lab 3: File I/O Observation

    Probe the VFS layer with kprobes on vfs_read and vfs_write to observe per-process file I/O volume in real time.

  4. 4 intermediate

    Tuxscope Lab 4: Network Monitoring

    Monitor TCP connections in real time by probing tcp_v4_connect and inet_csk_accept, capture source and destination IPs, ports, and connection direction.

  5. 5 intermediate

    Tuxscope Lab 5: Tracing Process Lifecycle with eBPF

    Trace fork, exec, and exit events in real time to understand how Linux creates, transforms, and destroys processes.

  6. 6 intermediate

    Tuxscope Lab 6: Observing Memory with Page Fault Tracing

    Trace page faults and OOM kills to understand how Linux implements virtual memory through demand paging.

  7. 7 intermediate

    Tuxscope Lab 7: Profiling Disk I/O Latency with eBPF HashMaps

    Use eBPF HashMap state to trace the block layer and measure per-request I/O latency from issue to completion.

All tutorials and learning paths