eBPF: tracing syscalls without a kernel moduleAttaching a verified program to a tracepoint, and why this beats strace under load.