eHashPipe: Lightweight Top-K and Per-PID Resource Monitoring with eBPF

Abstract: System-level resource monitoring with both precision and efficiency is a continuous challenge. We introduce eHashPipe, a lightweight, real-time resource observability system utilizing eBPF and the HashPipe sketching algorithm. eHashPipe supports two tracking modes: Top-k monitoring to identify the most resource-demanding processes and specific PID tracking to detail the behavior of selected processes. We implement two in-kernel eBPF pipelines for on-CPU time and memory usage. Unlike traditional userspace polling tools, eHashPipe operates in the kernel to reduce latency and context-switch overhead while keeping the runtime footprint small. During our experiments, eHashPipe attains 100 percent Top-k precision for CPU and memory at k = 1, 5, and 10, 95.0/90.0 percent at k = 20, and 93.3/83.3 percent at k = 30 compared to the ground truth. It exposes short-lived bursts with about 14 times finer temporal resolution than top while imposing very low overhead. These results show that eHashPipe delivers accurate, responsive insight with minimal impact, making it well suited for latency-sensitive cloud and edge environments.