eBPF

Extended Berkeley Packet Filter (eBPF) programs can observe or influence networking, system calls, and other kernel activity without changing kernel source code.

For example, an eBPF tool can measure which processes perform the most file reads.