CROSS-LAYER CORRELATION OF LINUX LOGS AND EBPF TELEMETRY FOR ROOT-CAUSE LOCALIZATION

Abstract

To investigate cross-layer correlation of application logs and extended Berkeley Packet Filter (eBPF) telemetry for system-event graph reconstruction and root-cause localization in Linux systems. Methods. Observations are normalized into canonical events; structural relations rely on stable process and socket identities, while causal candidates are admitted to ranking after compatibility of the available evidence with the observed mechanism is checked. The method was evaluated in four consecutive experiments: passive observation of two long-running hosts, deep tracing, controlled injection of three known faults, and held-out validation on four previously unseen mechanisms. Results. Increasing telemetry volume did not monotonically improve localization. In the original experiment, the richest model and the log-only model both achieved mean reciprocal rank (MRR)=0.667, with mean candidate-set sizes of 124.83 and 1.62. For known mechanisms, mechanism-aware admissibility increased Top-1 from 0.667 to 1.000. On held-out mechanisms, domain Top-1 and candidate coverage were 0.450 (9/20) for both E-R and F0. Across the same 20 fault windows, E-R generated 4,035 candidates (mean=201.75), whereas F0 generated 19 (mean=0.95). Thus, the reproducible effect of F0 on this sample is a substantial reduction of the candidate search space at unchanged coverage=0.450; the result does not imply high diagnostic completeness or establish filter safety outside the evaluated data. Conclusion. The principal observed limitations were related to evidence availability, causal representation, and candidate generation. For information-security use, the method should be interpreted as an evidence-correlation layer for incident triage and response rather than as a standalone attack detector.