Ebpf observability