eBPF for observability — tracing without modifying NF code

The Production Observability Problem

In production, you often need to measure something about a running NF without the disruption of redeploying. A latency p99 spike appears in dashboards and you need to know which function inside the AMF is slow; a memory leak appears and you need to know which allocation site is responsible; a particular UE keeps failing registration and you need to see what their NAS messages contain. Traditional approaches — adding log lines, recompiling, deploying — take hours and disrupt the production system. eBPF lets you attach probes to a running binary, measure what you need, and detach when done. No…