short answers
q&a
Short answers to real questions from the observability trenches. No preamble, no padding.
Is eBPF production-ready for observability use cases?
For profiling and network observability on a modern Linux kernel, yes. Cilium, Parca, Pixie and Tetragon all run in production. The caveats are kernel version and BTF support, the privileges the agent needs, and application-level tracing, which still trails what an SDK gives you.
What is an SLI and how do you choose one?
An SLI (Service Level Indicator) is a quantitative measure of some aspect of your service's behaviour from the user's perspective. The best SLIs measure what users actually care about — not server-side proxies. Choose the metric that, when it degrades, users notice.
What's the real difference between profiling and tracing?
Tracing tells you which path a request took and how long each hop took. Profiling tells you what your CPU was actually doing during those hops. They're complementary — use both.
Why are my structured logs still unstructured strings?
What is synthetic monitoring, and how does it differ from RUM?
Synthetic monitoring runs scripted user journeys on a schedule, so it catches outages even when nobody is using the service. RUM records what real users experience on their own devices and networks. Synthetic tells you the service is up. RUM tells you the experience is good. You need both.