Shipping whyslow v1

The problem

Every Linux dev has hit “my program is slow” and reached for strace,
perf, or py-spy — but each tool sees one layer. None of them tell you
why across layers. You end up manually cross-referencing three terminal
windows and timestamps by hand.

What I built

whyslow — a CLI that watches sched_switch, futex, and block I/O events
via eBPF and stitches them into a single causal chain:

$ sudo whyslow run -- ./my-slow-program
 
14:32:07.001 — tid 4821 blocked 412ms on futex 0x7f2a3c001000
 ← woken by tid 4809
 ← tid 4809 blocked 380ms on block I/O (dev nvme0n1p2, sector 88213)

No manual correlation. It finds the root cause and walks you back to it.

Stack

• Rust, aya for pure-Rust eBPF (no libbpf/C toolchain needed)
• Ring buffer for low-overhead event collection — can’t perturb the thing
  you’re measuring
• Interval tree + happens-before edge inference for the causal graph
• Workspace: whyslow-cli, whyslow-ebpf, whyslow-common

Scope for v1

• x86_64 + aarch64 Linux, kernel 5.8+
• Three event sources: sched_switch, futex, block I/O
• No stack symbolication yet — tid/pid/comm only
• Needs root or CAP_BPF — no way around that, eBPF is privileged
  Kept scope narrow on purpose: three event sources done correctly beats
  eight done half right. Validated against a synthetic program that
  deliberately causes futex contention + a disk stall, so there’s ground
  truth to check the causal chain against, not just vibes.

Distribution

• curl -sSf .../install.sh | sh
• Homebrew tap, APT repo, pip wrapper — see DISTRIBUTION.md
• crates.io publish still pending — cargo install works via --git for now

What’s next

• Stack symbolication (native + interpreted languages)
• More event sources without losing causal-chain accuracy
• Actual crates.io publish so cargo install whyslow just works

Repo

github.com/kaorii-ako/whyslow