This is changing! (or technically, has changed!) eBPF recently added the ability to look through internal data structures through iterators [0] so instead of p

This is changing! (or technically, has changed!) eBPF recently added the ability to look through internal data structures through iterators [0] so instead of parsing text we can run a program that traverses through all the task_structs and pushes the exact information we want to userspace in the form the developer wants. So, alongside other tradeoffs, it's more flexible than syscalls. [0] https://developers.facebook.com/blog/post/2022/03/31/bpf-iterator-retrieving-kernel-data-with-flexibility-and-efficiency/ https://developers.facebook.com/blog/post/2022/03/31/bpf-ite...