eBPF observability