{"slug": "show-hn-agentsight-ebpf-observability-for-ai-agents-no-code-changes", "title": "Show HN: AgentSight – eBPF observability for AI agents, no code changes", "summary": "AgentSight, a zero-instrumentation AI agent observability tool based on eBPF, captures LLM API calls, token consumption, and process behavior at the kernel level without code changes. It requires Linux kernel 5.8 or higher with BTF support and root or CAP_BPF privileges, and is installable via the ANOLISA CLI or YUM. The tool provides token analysis, behavior audit, dashboard visualization, agent auto-discovery, interruption detection, and external log export, with a systemd unit for deployment and a web UI at http://localhost:7396.", "body_md": "AgentSight is a zero-instrumentation AI Agent observability tool based on eBPF. It captures LLM API calls, Token consumption, and process behavior at the kernel level without modifying Agent code.\n\nAgentSight provides full-stack observability for AI Agents running on Linux:\n\n| Capability | Description |\n|---|---|\n| Token consumption analysis | Multi-dimensional Token accounting by agent, task, and model |\n| Behavior audit | Complete tracing of LLM calls and process execution |\n| Dashboard visualization | Web UI for real-time Token trends, Agent health, and session traces |\n| Agent auto-discovery | Automatic detection of running AI Agent processes |\n| Interruption detection | Detection of LLM errors, SSE truncation, context overflow, and crashes |\n| External log export | Supports exporting structured events to external log services |\n\n| Requirement | Minimum |\n|---|---|\n| OS | Linux |\n| Kernel | >= 5.8 (BTF support required) |\n| Privileges | root or CAP_BPF (for eBPF probes) |\n| ANOLISA raw package | Linux x86_64, system mode |\n\nmacOS: On macOS, AgentSight provides two commands —`trace`\n\n(trajectory collector that scans local JSONL session files, no eBPF) and`serve`\n\n(Dashboard viewer). All other eBPF-dependent commands are Linux-only.\n\nInstall the published component with the ANOLISA CLI:\n\n```\n# Recommended (system mode required — eBPF needs root)\nsudo anolisa install agentsight\n\n# Alternative (Alinux, requires YUM repo configuration)\nsudo yum install agentsight\n\n# Source build (developers only)\ncd src/agentsight && make build-all\n```\n\nUse\n\n`make build-all`\n\nfor source builds: it builds the Dashboard frontend, the main binary, and`agentsight-enforcer`\n\nin sequence. Running only`make build`\n\nskips the enforcer, and`serve`\n\nwill keep logging`AgentSight enforcement unavailable`\n\n.\n\nUse the systemd unit for a normal deployment. It runs eBPF tracing and the Dashboard together and starts the enforcer dependency in the required order:\n\n```\nsudo systemctl enable --now agentsight.service\nsudo systemctl status agentsight.service\n```\n\nOpen `http://localhost:7396`\n\nafter the service becomes active. Enabling the\nmain unit also keeps AgentSight available after a reboot.\n\nThe bundled systemd launcher binds the Dashboard to `0.0.0.0`\n\n. Restrict port\n7396 with a firewall or security group before exposing the host to an\nuntrusted network.\n\nThe service runs as root with a private umask and stores data under\n`/var/log/sysak/.agentsight`\n\n. Use `sudo`\n\nfor CLI queries and Dashboard access\ncommands that read this service-owned data.\n\nFor foreground troubleshooting, stop the systemd unit first so it does not\ncompete with a second tracer. Then use two terminals and run both commands as\nroot. The second command is not reached if both are entered sequentially\nbecause `agentsight trace`\n\nstays in the foreground:\n\n```\nsudo systemctl stop agentsight.service\n\n# Terminal 1\nsudo agentsight trace\n\n# Terminal 2: Start Dashboard\nsudo agentsight serve\n# Open http://localhost:7396 in browser\n\n# Print the Dashboard URL and token; open the URL as your desktop user\nsudo agentsight dashboard --no-open\n```\n\nLocalhost access is authentication-free; remote access requires a token, see\n\n[Dashboard Access & Authentication].\n\nStarts kernel-level capture of AI Agent activity.\n\n```\nsudo agentsight trace\n```\n\nRequires root privileges. Captures SSL/TLS traffic, process events, and file operations. Run\n\n`sudo systemctl stop agentsight.service`\n\nbefore starting a foreground tracer.\n\n```\n# Default: bind to 127.0.0.1:7396\nsudo agentsight serve\n\n# Bind to all interfaces (remote access)\nsudo agentsight serve --host 0.0.0.0 --port 7396\n```\n\nRun `serve`\n\nas the same user that runs `trace`\n\nso both commands resolve the\nsame data directory. Binding to `0.0.0.0`\n\nexposes the Dashboard on every\ninterface; restrict network access before using that form.\n\nDashboard token authentication is enabled by default:\n\n**Localhost access**(loopback) bypasses authentication — just open`http://127.0.0.1:7396`\n\n.**Remote access** requires a token: append`?token=<TOKEN>`\n\nto the browser URL, or set the`Authorization: Bearer <TOKEN>`\n\nHTTP header.- The token is auto-generated on the first\n`serve`\n\nstartup (64 hex characters) and persisted to the`.dashboard_token`\n\nfile next to the database (default`/var/log/sysak/.agentsight/.dashboard_token`\n\n); it is reused across restarts. - Run\n`sudo agentsight dashboard --no-open`\n\nto print the service-owned access URL and token, then open the URL as your desktop user.\n\nTo disable authentication (only recommended on trusted internal networks), set in the config file:\n\n```\n{\n  \"server\": { \"auth\": { \"enabled\": false } }\n}\n```\n\nAfter editing `/etc/agentsight/config.json`\n\n, run `sudo systemctl reload agentsight.service`\n\nto apply the change — no `restart`\n\nneeded.\n\n`GET /api/docs`\n\nreturns the full API route inventory (method, path, description) so scripts and integrations can discover endpoints; requests to unknown `/api/`\n\npaths also point to it in the 404 response.\n\n```\ncurl http://127.0.0.1:7396/api/docs\n```\n\nDisplays the Dashboard URL and auth token, then tries to open a browser. On ECS instances it also prints a security-group configuration guide.\n\n```\n# Show URL and token without opening a root-owned browser\nsudo agentsight dashboard --no-open\n```\n\nRolls up sessions and Token usage, interruption events grouped by severity, and Tokenless savings for a recent time window — one command for the overall health picture.\n\n```\n# Last 24 hours (default)\nagentsight summary\n\n# Last 7 days, JSON output\nagentsight summary --last 168 --json\n```\n\nData sources degrade independently: a missing database contributes zeros without affecting the rest of the report.\n\n```\n# Today's usage\nsudo agentsight token\n\n# Weekly comparison\nsudo agentsight token --period week --compare\n\n# JSON output\nsudo agentsight token --json\n# Recent events\nagentsight audit\n\n# Filter by PID and type\nagentsight audit --pid 12345 --type llm\n\n# Summary statistics\nagentsight audit --summary\n# Discover running AI Agents\nagentsight discover\n\n# List known Agent types\nagentsight discover --list-known\n```\n\nQuery and manage AI Agent session interruption events.\n\n**Interruption types:**\n\n| Type | Description | Default Severity |\n|---|---|---|\n`llm_error` |\nHTTP status >= 400 or SSE body contains error | high |\n`sse_truncated` |\nSSE stream ended without `finish_reason=stop` |\nhigh |\n`context_overflow` |\nContext length exceeded | high |\n`agent_crash` |\nAgent process disappeared mid-session | critical |\n`token_limit` |\n`finish_reason=length` with output near max |\nmedium |\n\n```\n# List interruption events (default: last 24h)\nagentsight interruption list [--last <HOURS>] [--type <TYPE>] [--severity <LEVEL>]\n\n# Statistics by type\nagentsight interruption stats\n\n# Count by severity\nagentsight interruption count\n\n# Get a single event by ID\nagentsight interruption get <ID>\n\n# List all interruption events of a session / conversation\nagentsight interruption session <SESSION_ID>\nagentsight interruption conversation <CONVERSATION_ID>\n\n# Mark as resolved\nagentsight interruption resolve <ID>\n```\n\nConfiguration file: `/etc/agentsight/config.json`\n\n(override with `--config`\n\n).\n\nImportant: User config filesreplace(not extend) the built-in default rules. Ensure your config includes all Agent rules you need.\n\n| Feature | JSON Path | Default | Description |\n|---|---|---|---|\n| Token stats | `features.token_stats` |\n`true` |\nCore Token accounting |\n| SQLite storage | `features.sqlite_storage.enabled` |\n`true` |\nLocal persistence |\n| Interruption detection | `features.interruption_detection.enabled` |\n`true` |\nError/crash detection |\n| Audit | `features.audit` |\n`true` |\nLLM call audit |\n| Session mapping | `features.session_mapping.enabled` |\n`true` |\nresponseId→sessionId |\n\n| Config | Default | Description |\n|---|---|---|\n`event_channel_capacity` |\n10,000 | Probe event bounded channel capacity |\n`pending_genai_max_count` |\n1,000 | Max events awaiting session_id |\n`max_connection_body_mb` |\n8 | Single HTTP connection body buffer limit |\n`ring_buffer_mb` |\n32 | eBPF Ring Buffer size (must be power of 2) |\n\nAgentSight provides a built-in conversational skill for Copilot Shell. Users can query Token usage and audit logs via natural language:\n\n- \"How much Token did I use today?\"\n- \"Show me today's LLM call records\"\n\nAgentSight integrates with the Tokenless component to display Token savings data in the Dashboard. No additional configuration needed — if both are installed, savings data appears automatically.\n\nDefault maximum database size: 200 MB. When reached, automatic cleanup triggers.\n\nCustomize via environment variable:\n\n```\nexport AGENTSIGHT_GENAI_DB_MAX_SIZE_MB=500\nrm -rf /var/log/sysak/.agentsight\n# Then restart AgentSight\n```\n\n**Q: Why can't I see Token data for OpenClaw?**\n\nA: AgentSight monitors the `openclaw-gateway`\n\ndaemon. Check client-gateway connectivity. If you see \"pairing required\" errors, run `openclaw devices approve`\n\n.\n\n**Q: Why does the Token savings page show 0?**\n\nA: Possible causes: (1) The AK/SK authentication mode is not yet supported; (2) Session ID format is non-standard UUID.\n\n**Q: Why do cumulative savings exceed the single-call difference?**\n\nA: Agents include historical messages in context. Savings accumulate across turns, so cumulative savings exceed per-turn differences.", "url": "https://wpnews.pro/news/show-hn-agentsight-ebpf-observability-for-ai-agents-no-code-changes", "canonical_source": "https://github.com/alibaba/anolisa/blob/main/docs/user-guide/en/agent-observability/agentsight.md", "published_at": "2026-08-21 15:21:10+00:00", "updated_at": "2026-08-21 15:44:31.969646+00:00", "lang": "en", "topics": ["ai-tools", "ai-infrastructure", "developer-tools"], "entities": ["AgentSight", "ANOLISA", "Linux"], "alternates": {"html": "https://wpnews.pro/news/show-hn-agentsight-ebpf-observability-for-ai-agents-no-code-changes", "markdown": "https://wpnews.pro/news/show-hn-agentsight-ebpf-observability-for-ai-agents-no-code-changes.md", "text": "https://wpnews.pro/news/show-hn-agentsight-ebpf-observability-for-ai-agents-no-code-changes.txt", "jsonld": "https://wpnews.pro/news/show-hn-agentsight-ebpf-observability-for-ai-agents-no-code-changes.jsonld"}}