Opening the fieldwork…
A practical companion for your time inside the machine.
Use a reference when a specific question needs it. During an independent attempt, record any outside help you use.
sys_enter_execve records an attempt before a result exists; observation is narrower than successful execution.
Correlate host PID/TGID with timestamp. Names change and PIDs can be reused across time.
A snapshot reports what exists at sampling time; an event can capture work between snapshots.
Concurrent threads can call openat independently. Entry arguments must be paired with the correct thread's return.
A nonnegative return is a descriptor, including zero. Negative values encode errors: -2 is ENOENT and -13 is EACCES. Neither result explains why the application selected the path.
A relative pathname is interpreted using dirfd or the current directory and the process filesystem view.
Destination address/port, host identity and timing connect an entry to the right return.
A blocking connect's return reports the result for that attempt, not general service health.
EINPROGRESS requires later completion evidence; initiation and establishment are distinct boundaries.
Uprobe and uretprobe timestamps measure time inside resolve_backend, not a remote server in isolation.
An intentional fixture delay is known experimental input and must be reported as such.
A long wrapper interval leaves cache, NSS, scheduler and network contributions unresolved without additional measurements.
Address and port pairs distinguish affected traffic from unrelated flows in aggregate counts.
A retransmit tracepoint records the kernel's path, not a direct packet-loss measurement.
Equal-duration baseline and loss windows support a bounded comparison; qdisc cleanup is part of the experiment.
The same process may have different host and namespace-visible PIDs; filters must use the observer's domain.
Reading /proc after an event can fail if the process exits first; missing enrichment is not proof of a missing event.
A numeric cgroup ID helps correlate context but is not a human-readable container identity.
The verifier evaluates program safety before attachment. A load failure differs from an attached observer receiving no events.
CO-RE relocates supported type/layout references using BTF; it does not equal universal helper or verifier compatibility.
Record kernel, object, logs, attachment and workload result for each tested environment rather than extrapolating from one success.
Start with a symptom and a prediction. A hook is useful when it answers a specific question.
Write down the event and identity fields you expect before running the observer.
Collect the real output. Inspect timestamps, identity, return values and the capture window.
State what the evidence establishes, then name what it cannot tell you.
Change one condition. Check whether your reasoning still holds.
The observation diagrams explain a specific measurement boundary. Selecting a received record displays its actual fields. Conceptual diagrams never imply a successful execution.
Start with process execution →Labs 03–06 run in a disposable Linux VM. This learner release supports a macOS host with Lima 2.0 or newer and the pinned Ubuntu 24.04 x86_64 guest. The commands below run in a local clone of this repository.
git clone https://github.com/danielAsaboro/ebpf-incident-lab.git
cd ebpf-incident-labDownload the pinned v0.1.1 learner bundle and check it against the repository’s published checksums.
mkdir -p vm/artifacts
curl --fail --location \
https://github.com/danielAsaboro/ebpf-incident-lab/releases/download/v0.1.1/incident-lab-x86_64.tar.zst \
--output vm/artifacts/incident-lab-x86_64.tar.zst
(
cd vm/artifacts
awk '$2 == "incident-lab-x86_64.tar.zst"' ../../release/SHA256SUMS | shasum -a 256 --check
)./scripts/lab-vm.sh start
./scripts/lab-vm.sh doctor
./scripts/lab-vm.sh shellOpen a second host terminal and run the shell command again for the fixture. Inside the guest, observers run from native storage at /opt/incident-lab.
incident-lab doctor
incident-lab listEach local investigation contains its own observer and fixture commands. Nothing in this web interface runs shell commands on your machine. Paste actual output into the investigation to keep an explicitly unverified local record.
After fieldwork, use ./scripts/lab-vm.sh stop on the host. Reset and delete are separate destructive operations with explicit terminal confirmations.
Received from the configured Linux runner. A successful run applies to that object, kernel and observation window.
Pasted by you and labeled user-provided. The application cannot independently verify its origin or execution.
Stored in this browser, including the output you record. They are historical notes, not a current live session. Delete individual notebooks from My notebooks.
No matching event reached the observer. That does not establish that the incident never happened.
Explain relationships. They are not actual process topology, physical kernel layouts, network measurements or verifier disassembly.
This deployment has no configured runner credentials. The UI remains usable; use the local VM guides or a deployment with a configured runner.
Run the fixture after the observer reports ready. Check the capture duration and ensure --pid refers to a host PID.
Use the exact pinned archive and published checksum. The launcher will not silently download or rebuild a replacement.
Returning to a notebook restores its notes and received events. It does not automatically restart a runner session. Return to your prediction to start another observation.
The raw evidence, lab content and notebook remain usable without a diagram or WebGL.
Use the fixture binary on the VM's native filesystem, not the macOS shared mount. Check the exact INCIDENT_DNS_FIXTURE path.