Open-source alternatives to Pixie

Coroot is an observability platform and Kubernetes performance monitor that utilizes eBPF to automatically collect metrics, logs, and traces without requiring manual code instrumentation. It functions as an OpenTelemetry trace analyzer and an LLM observability gateway, exposing system health data to large language models through the Model Context Protocol. The platform differentiates itself by combining automated root cause analysis and AI-driven diagnostics to investigate performance regressions. It also includes a cloud cost monitoring tool that attributes infrastructure spending to specifi

Hubble is an eBPF-based Kubernetes observability platform designed for network monitoring, security auditing, and flow inspection. It provides deep visibility into containerized traffic and cluster security by utilizing kernel-level hooks to collect network events. The system features a service map for visualizing communication patterns and dependencies between microservices and external endpoints. It incorporates identity-based flow labeling to track network traffic using Kubernetes labels rather than volatile IP addresses. The platform covers a broad range of monitoring capabilities, inclu

The OpenTelemetry eBPF profiler is a system-wide performance monitoring agent that captures stack traces and resource usage across kernel and user-space runtimes. By utilizing kernel-level tracing, it provides continuous observability into application behavior without requiring manual code instrumentation or process restarts. The tool distinguishes itself through its ability to perform mixed-language stack unwinding, which reconstructs call chains across native code and managed virtual machines. It handles environments lacking frame pointers or debug symbols by parsing binary metadata and exc

This project is a performance analysis tool for Ruby applications using the Rack interface. It monitors request execution times and resource usage, serving as a profiler for web applications to measure latency and identify bottlenecks. The tool provides specific analyzers for database query performance, memory allocations, and garbage collection statistics. It generates call stack flamegraphs to visualize time distribution across methods and renders speed badges and timing metrics directly onto HTML pages. The system covers broader performance profiling capabilities including custom code blo

Laravel Debugbar is a web-based debugging toolbar and application profiler for Laravel. It provides a visual interface to inspect database queries, logs, and performance metrics in real time to identify and resolve bugs during development. The tool features a database query monitor to capture SQL statements and timings, as well as a request inspector for analyzing route metadata, loaded views, and HTTP request data. It includes a profiler for measuring execution time and memory usage to identify bottlenecks in the request lifecycle. Its observability capabilities cover exception capture, app

Suricata is an open-source network intrusion detection and prevention engine that analyzes live network traffic in real-time to identify and alert on malicious activity. It operates as a rule-based threat detection system, matching traffic against user-defined signatures to detect known attack patterns and policy violations, and can be placed inline to actively block malicious packets before they reach their target. The engine inspects a wide range of application-layer protocols including HTTP, DNS, TLS, SMB, and MQTT, and supports high-performance packet capture through specialized hardware a

Netfox is an iOS and macOS network debugging library designed to intercept and monitor HTTP traffic. It functions as an in-app HTTP traffic inspector that captures request headers and response bodies for real-time network analysis. The tool provides a network performance monitor to calculate response times and data sizes, as well as a network log exporter for sharing captured request and response data via email. The project covers network analysis capabilities including traffic filtering to exclude specific URLs, request body capture, and a debug interface that can be toggled via programmati

SkyWalking is an application performance monitoring system and observability platform designed to collect and analyze metrics, traces, and logs from distributed microservices. It functions as a distributed tracing platform and a telemetry data pipeline that ingests and aggregates observability data from various language agents. The project features an AI-powered anomaly detector that uses machine learning to calculate metric baselines and identify irregular URI patterns. It includes an eBPF performance profiler for diagnosing CPU and network bottlenecks at the kernel level and generates inter

gops is a command-line diagnostic toolset for monitoring, profiling, and managing the runtime state of active Go applications. It functions as a runtime diagnostic tool that provides a focused interface for analyzing memory, profiling performance, and monitoring the health of running processes. The tool provides a set of specialized utilities including a performance profiler for capturing CPU and heap profiles, a memory analyzer for identifying leaks and triggering garbage collection, and a process monitor for discovering running binaries and visualizing process hierarchies. The project cove

Pinpoint is a distributed application performance monitoring and tracing system. It functions as an application performance monitor and topology visualizer designed to analyze the execution behavior of large-scale distributed applications. The system uses bytecode instrumentation to monitor applications without requiring changes to the original source code. It captures call stacks and request flows across interconnected services to visualize system dependencies and generate real-time architectural maps of communication patterns. The platform covers a broad range of observability capabilities

This project is a cloud infrastructure simulator and system design educational tool. It provides a sandbox environment for designing virtual network topologies and testing the resilience of system architectures under high traffic and simulated attacks. The platform functions as an infrastructure resilience sandbox where users can experiment with the architectural placement of load balancers, caches, and databases. It allows for the validation of auto-scaling strategies, rate limiting, and firewall configurations to prevent service degradation. The simulator covers network traffic management,

Meshery is a service mesh management plane and cloud native infrastructure orchestrator. It provides a visual design-as-code environment for modeling microservices and infrastructure components through declarative blueprints, functioning as a centralized platform for designing, deploying, and managing service mesh infrastructure. The platform is distinguished by its ability to translate visual designs into active deployments and its use of gRPC-based adapters to integrate with diverse infrastructure providers. It features a multi-tenant architecture that manages shared workspaces and role-bas

Snowflake is a high-concurrency RPC framework and distributed ID generation service. It provides the infrastructure to create unique, time-ordered identifiers across a network of servers and facilitates the development of network services designed to handle massive volumes of simultaneous requests. The system separates low-level transport logic from application behavior, allowing for the implementation of custom RPC protocols. It includes a distributed request tracing tool to visualize execution flow across network boundaries and a server lifecycle management interface to adjust logging level

Helicone is an AI gateway and observability platform designed to intercept, manage, and monitor interactions with large language models. By acting as a reverse-proxy, it provides a centralized layer for routing requests across multiple AI providers, allowing developers to maintain consistent application logic while gaining deep visibility into model performance, usage, and costs. The platform distinguishes itself through a robust suite of traffic management and prompt engineering tools. It enables policy-driven control, including automatic failover between providers, rate limiting, and edge-b

Pigsty is a comprehensive database infrastructure orchestration platform designed to automate the full lifecycle of high-availability PostgreSQL clusters. It functions as an infrastructure-as-code framework that manages cluster coordination, node provisioning, and service discovery through idempotent playbooks. By integrating distributed consensus mechanisms, the platform ensures automated failover and consistent state enforcement across diverse environments, including bare metal and virtualized infrastructure. The platform distinguishes itself through a robust suite of operational capabiliti

Boto3 is the AWS SDK for Python, providing a programmatic interface for managing and automating AWS cloud infrastructure and services. It serves as a cloud management API client and resource manager for provisioning, configuring, and scaling virtual servers, databases, and storage. The library enables the implementation of infrastructure-as-code through declarative templates and scripts, allowing for the deployment of identical resource stacks across multiple accounts and geographic regions. It also provides a framework for coordinating distributed workflows, serverless functions, and contain

The 1BRC (One Billion Row Challenge) is a Java performance benchmarking exercise that processes one billion temperature records from a text file to compute the minimum, mean, and maximum temperature per weather station. At its core, it is a large-scale data aggregation challenge designed to test how efficiently a Java program can parse and aggregate structured data from a plain text file, serving as both a programming exercise and a benchmark for Java performance optimization. The project distinguishes itself through a collection of performance-oriented architectural patterns for high-through

Mizu is a suite of tools for capturing, indexing, and visualizing cloud-native network traffic and decrypted payloads for cluster-wide diagnostics. It provides Kubernetes network observability by using eBPF to index and visualize layer 4 and layer 7 traffic with full cluster context, allowing for the mapping of workload dependencies and the diagnosis of network failures. The project distinguishes itself by using kernel-level hooks to decrypt TLS traffic in plain text without requiring private keys. It further integrates a standardized context protocol to expose indexed network telemetry to AI

Inspektor Gadget is an eBPF observability toolset and program framework designed for tracing Linux systems and debugging Kubernetes nodes. It provides a suite of tools to collect kernel-level telemetry and export system metrics via the OpenTelemetry standard. The project distinguishes itself by packaging inspection tools as OCI-compliant container images, allowing for standardized distribution and deployment across clusters and hosts. It employs a modular data processing pipeline that utilizes WebAssembly modules to transform and filter telemetry, and leverages Compile Once Run Everywhere for

Kubeshark is a network observability platform designed for Kubernetes environments, functioning as an eBPF-powered engine for cluster-wide traffic analysis. It captures, indexes, and visualizes network activity and API calls directly from the kernel, providing deep visibility into service-to-service communication without requiring sidecar proxies or manual code instrumentation. The platform distinguishes itself through its ability to perform protocol-aware traffic dissection and user-space cryptographic hooking, which allows for the inspection of encrypted traffic and the reconstruction of ap

pwru is a tooling implementation for tracing, filtering, and debugging network packet movements and transformations within the Linux kernel. It functions as an eBPF network packet tracer and debugger used to analyze kernel state and identify where network packets are dropped or redirected. The project provides specialized capabilities for monitoring the packet lifecycle, including tracking packets through NAT transformations and tunnel decapsulation. It includes an eBPF traffic filter that reduces noise by restricting traced packets based on namespaces, interfaces, and kernel function names.

Pyroscope is a continuous profiling platform designed to collect, store, and visualize application performance data. It functions as an application performance management suite that tracks historical resource usage to identify bottlenecks and detect performance regressions over time. The platform distinguishes itself through its use of kernel-level instrumentation and dynamic runtime hooks, which allow for performance monitoring without requiring manual code modifications or application restarts. It employs a sidecar agent architecture to offload telemetry processing, utilizing delta-encoded

Parca is an always-on continuous profiling platform that captures CPU and memory usage from running applications without any code modifications. It uses eBPF kernel-level tracing to automatically discover and sample stack traces across infrastructure, and provides a web-based flame graph dashboard for interactive performance analysis. Its label-based query engine lets users slice and aggregate profiling data across dimensions such as service, container, or region, using a Prometheus-style selector syntax. Unlike basic profilers, Parca stores profile samples in a columnar format using Apache A

Samply is a cross-platform CPU sampling profiler and performance analysis utility. It consists of a command-line tool for recording process stack traces at regular intervals and a visual interface for analyzing the resulting execution data. The system includes a debug symbol resolver that maps raw memory addresses to human-readable function names using local or remote symbol information. It transforms recorded execution data into flame graphs and timelines to pinpoint function-level hotspots. The tool provides capabilities for CPU execution recording, stack unwinding, and symbol resolution a

Async-profiler is a sampling profiler for Java applications that tracks CPU time and stack traces across execution frames to identify performance bottlenecks. It is designed to capture profiling data without introducing timing bias. The project provides capabilities for JVM memory analysis to locate native and heap allocation hotspots and memory leaks. It also includes system contention analysis to identify resource bottlenecks through the tracking of contended locks and hardware performance counters. The tool converts raw profiling data into visual performance reports, including interactive

Kyanos is a diagnostic toolset for network analysis that uses eBPF to measure packet latency and trace traffic from the network card to the application. It functions as a kernel latency profiler and network performance monitor, providing capabilities to map external dependencies and capture network traffic. The project is distinguished by its ability to perform automatic SSL traffic decryption, converting encrypted requests and responses into plaintext for analysis. It further isolates bottlenecks by attributing latency across multiple stages, specifically tracing the time packets spend withi

Easy Profiler is a performance profiling library for C++ applications designed to measure execution duration and identify bottlenecks. It provides a framework for instrumenting code blocks to track performance metrics, allowing for the analysis of thread activity and system behavior through detailed timeline visualization. The library distinguishes itself by utilizing scope-based instrumentation to automatically track code lifecycles, minimizing manual overhead. It employs thread-local buffering and asynchronous data flushing to reduce synchronization contention, ensuring that performance dat