Not sure what to make of this project.
jälki removes that barrier. You ask a question. jälki hooks the right kernel function, collects the events, and interprets them:
❯ jalki ask "why is postgres slow"
Probes selected:
tcp_connect (fexit/kernel.tcp.connect)
tcp_retransmit_skb (fentry/kernel.tcp.retransmit)
attached tcp_connect → probe_001
attached tcp_retransmit_skb → probe_002
Collecting events for 5s...
Collected 47 events. Interpreting...
# Question: why is postgres slow
## Events observed (47 total in 5s)
jalki/tcp_connect: 12 events
jalki/tcp_retransmit: 35 events
## Interpretation
**tcp_retransmit_skb** (warning)
packets are being lost on an active connection — network congestion,
switch issue, or physical layer problem between nodes
Action: check network path between 10.42.1.15 and 10.42.2.8.
this is a network problem, not application.
Although it seems like it’s querying a LLM for this, it isn’t. The plain language is pattern-matched against entries in a knowledgebase to determine the correct eBPF trampolines.
The knowledge folder has JSON files with pre-loaded interpretations.