bpftrace gives you facts about a running kernel that no log will ever contain. The model’s job is not to run it — that stays you — but to turn the output into a sentence you can act on.
Start with a question, not a tool
“Which process is opening files under /etc at three in the morning?” is a question. The tool follows:
bpftrace -e 'tracepoint:syscalls:sys_enter_openat
/str(args->filename) == "/etc/*"/
{ printf("%s %d %s\n", comm, pid, str(args->filename)); }'What the model adds
It clusters. Twenty thousand identical lines are one fact, and the interesting output is the tail: the one process that appears twice at 03:12 with a different parent. Ask for that, explicitly:
Here are counts per (comm, filename). Name the three entries that do not share a parent process with the rest, and say nothing else.
Narrow asks get narrow answers. “Analyse this” gets a paragraph of plausible nothing.
The verification step
ps -o pid,ppid,cmd -p <pid>
systemctl status <unit> --no-pager | head -5Two commands that either confirm the sentence or kill it. If they kill it, the model was not wrong about the data — it was wrong about the cause, and that is the failure mode worth reading for.