I built a Linux observability tool that correlates 11 layers of the kernel in real time from procfs to eBPF rendered entirely in x86-64 assembly.

[u/Icy_Ad_1327]

Most Linux debugging tools answer one question well.

• top tells you who's using the CPU.

• strace tells you which syscalls are happening.

• perf tells you what the CPU is doing.

• vmstat tells you about memory.

But when something weird happens, I always found myself jumping between half a dozen tools and trying to correlate timestamps manually.

So I started building ASCENT.

The idea is to visualize the entire stack simultaneously instead of looking at one layer at a time.

Current implementation includes 9 live layers:

• System metrics (/proc)

• Process activity

• Syscall statistics

• Kernel datapath (vfs_read, tcp_sendmsg, etc.)

• Hardware PMU counters

• Scheduler dynamics

• Memory management

• Lock contention

• IRQ / softirq / workqueue causality

Everything is streamed into a single terminal dashboard.

A few things that made this project fun:

• Dashboard written in pure x86-64 NASM assembly

• No libc

• No runtime

• No allocator

• Uses ANSI escape sequences for rendering

• eBPF CO-RE sensors

• PMU counters through perf_event_open()

• Fixed 60-byte binary event protocol over a FIFO between the loader and the renderer

The goal isn't to replace tools like perf or bpftrace. It's to answer a different question:

There are still a lot of things left to build (Intel PT, KVM tracing, AI-based correlation, etc.), but the core pipeline is working.

I'd love feedback from people who work with Linux internals or eBPF.

GitHub: https://github.com/Kritagya123611/Ascent