# Aquila: Efficient In-Kernel System Call Telemetry for Cloud-Native Environments

## TL;DR

Aquila is a new telemetry framework that improves system call monitoring in cloud-native environments by being more efficient and reliable.

## Contribution

Aquila introduces a dual-path kernel pipeline and priority-aware buffering to enhance telemetry efficiency and reliability.

## Key findings

- Aquila improves scalability and reduces event loss in system call telemetry.
- The framework enhances semantic completeness by enriching kernel traces with Kubernetes metadata.

## Abstract

System call telemetry is essential for understanding runtime behavior in cloud-native infrastructures, but existing eBPF-based monitors suffer from high per-event overhead, unreliable delivery under load, and limited context for correlating multi-step activities. These issues reduce scalability, create blind spots in telemetry streams, and complicate the analysis of complex workload behaviors. This work presents Aquila, a lightweight telemetry framework that emphasizes efficiency, reliability, and semantic fidelity. Aquila employs a dual-path kernel pipeline that separates fixed-size metadata from variable-length attributes, reducing serialization costs and enabling high-throughput event processing. It introduces priority-aware buffering and explicit drop detection to retain loss-sensitive events while providing visibility into overload conditions. In the user space, kernel traces are enriched with Kubernetes metadata, mapping low-level system calls to pods, containers, and namespaces. Evaluation under representative workloads shows that Aquila improves scalability, reduces event loss, and enhances the semantic completeness of system call telemetry compared with existing approaches.