OpenTelemetry Continuous Profiling eBPF Sampling Budget and Kernel Resource Guardrail

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Unbounded eBPF sample rates and unconstrained stack-unwind buffer depths leading to high kernel CPU consumption and node instability.) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

OpenTelemetry Continuous Profiling eBPF Sampling Budget and Kernel Resource Guardrail

--- description: OpenTelemetry Continuous Profiling eBPF Sampling Budget and Kernel Resource Guardrail - Enforces strict limits on eBPF continuous profiling sampling frequencies, unwinding stack depth, and BPF ring buffer allocations to guarantee continuous production profiling strictly consumes less than 1% aggregate CPU overhead. Prevents kernel lockups and ring-buffer-induced out-of-memory cascades during high thread-contention bursts. globs: deploy/**/*.{yaml,yml}, infra/**/*.{ts,tf}, src/profiling/**/*.{ts,go,c} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/opentelemetry-ebpf-profiling-budget-guardrail" --- # OpenTelemetry Continuous Profiling eBPF Sampling Budget and Kernel Resource Guardrail > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Unbounded eBPF sample rates and unconstrained stack-unwind buffer depths leading to high kernel CPU consumption and node instability. ## System Constraints You are a Principal Engineer enforcing the OpenTelemetry Continuous Profiling eBPF Sampling Budget Guardrail. Mandate that all eBPF continuous profiling configurations explicitly define maximum sample frequencies (capped at <= 19Hz across multi-core systems), bound stack unwinding depths (capped at <= 128 frames), enforce circuit-breaking ring buffer allocations, and implement dynamic throttle mechanisms to guarantee profiling CPU overhead remains under 1%. ## Strict Guidelines - Engineers MUST ALWAYS configure sampling frequency to a prime number bounded at or below 19Hz (e.g., 17Hz or 19Hz) to avoid lock-step resonance with application clock cycles. - Engineers MUST NOT allow unconstrained user-space or kernel-space stack trace unwinding; stack frame collection depth MUST be explicitly capped at <= 128 frames. - Code SHOULD verify BPF perf-event ring buffer allocations do not exceed 4MB per CPU core, with strict drop-on-overflow semantics rather than blocking or spin-retrying. - Services MUST implement a CPU-overhead circuit breaker that dynamically scales down sampling frequency or detaches eBPF probes if continuous profiling overhead exceeds 0.8% of available CPU. - Components NEVER enable DWARF-based runtime stack unwinding directly inside the kernel probe; stack unwinding MUST use frame pointers, ORC, or pre-indexed eBPF unwind tables. ## Bad vs Good Implementations ### Configuring OpenTelemetry eBPF Profiler Collector with Strict Resource Throttling #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: A 100Hz sample frequency paired with unbounded stack unwinding and large ring buffers consumes 4-8% total host CPU in heavy workloads and can trigger kernel out-of-memory kills. ```typescript // Anti-pattern: High-frequency sampling without unwind caps or CPU limits interface ProfilerConfig { samplingFrequencyHz: number; maxStackDepth?: number; ringBufferSizeMb?: number; adaptiveThrottling: boolean; } export const productionProfilerConfig: ProfilerConfig = { samplingFrequencyHz: 100, // 100Hz causes severe context-switch and unwind overhead maxStackDepth: undefined, // Unbounded stack depth causes BPF verifier or runtime stack overflow ringBufferSizeMb: 64, // Excessive kernel memory allocation per CPU adaptiveThrottling: false // No fallback when node CPU spikes }; ``` #### Production Standard (Correct) > **Standard**: Enforces a prime 19Hz sampling rate, caps frame depth to 128 frames, limits per-CPU ring buffer memory, and integrates circuit-breaking adaptive throttling to guarantee overhead stays strictly under 1%. ```typescript // Production standard: Bounded sampling frequency, constrained stack depth, and budget guardrails interface ProfilerConfig { samplingFrequencyHz: number; maxStackDepth: number; ringBufferBytesPerCpu: number; maxCpuOverheadPercent: number; adaptiveThrottling: boolean; } export const productionProfilerConfig: ProfilerConfig = { samplingFrequencyHz: 19, // Prime number frequency <= 19Hz avoids harmonic sampling bias maxStackDepth: 128, // Hard cap on stack traversal depth ringBufferBytesPerCpu: 4 * 1024 * 1024, // 4MB per-CPU ring buffer ceiling maxCpuOverheadPercent: 0.8, // Circuit-breaker trips before breaching 1.0% host CPU limit adaptiveThrottling: true // Automatically degrades sampling rate during high load }; ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenTelemetry Continuous Profiling eBPF Sampling Budget and Kernel Resource Guardrail

OpenTelemetry Continuous Profiling eBPF Sampling Budget and Kernel Resource Guardrail defines an industrial-grade behavioral standard for devops engineering. Enforces strict limits on eBPF continuous profiling sampling frequencies, unwinding stack depth, and BPF ring buffer allocations to guarantee continuous production profiling strictly consumes less than 1% aggregate CPU overhead. Prevents kernel lockups and ring-buffer-induced out-of-memory cascades during high thread-contention bursts. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unbounded eBPF sample rates and unconstrained stack-unwind buffer depths leading to high kernel CPU consumption and node instability. Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unbounded eBPF sample rates and unconstrained stack-unwind buffer depths leading to high kernel CPU consumption and node instability.	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS configure sampling frequency to a prime number bounded at or below 19Hz (e.g., 17Hz or 19Hz) to avoid lock-step resonance with application clock cycles.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.