IDENTITYKEYWAKEUPTEMPORAL
Correlation, with receipts.
A propagated identity and two events close in time are different kinds of evidence. Omniscient tells you which one supports the connection.
Understand the evidenceSee beyond
the surface.
Observe Linux workloads, from CPU to disk.
Keep the evidence beside every number.
ONE TOOL / A SHARED VOCABULARY
Measure the system.
Keep the meaning.
Follow a workload from kernel activity to the time it spends waiting. Profiles, counters and events share one model, with their limits kept visible.
- Begin with a question.
- Use
omn cpu,omn memoromn latencyto start an investigation. Name a source when you need precise control. - See what is available here.
omn listprobes this machine. Missing privilege, unsupported hardware and absent collectors come with explicit explanations.- Take the evidence with you.
- Export results and profiles. Keep the resolved backend, machine conditions and observation cost alongside the numbers.
NINE FAMILIES / CONNECTED QUESTIONS
Every layer has
a story to tell.
Choose the part of the system you want to understand. Open a family to read its story: the question, its sources, a real run and its limits.
FOLLOW THE SIGNAL / THE SUZANNE SCENARIO
One request.
Every layer in view.
Ask an engine to render Suzanne in 3D and save the result. Follow each handoff across the machine.
Planned Linux capture scenario · this sequence is illustrative. One host; GPU attribution depends on the engine and driver. File writes and durable device completion are distinct.
ENGINEERED FOR EVIDENCE
Visibility is good.
Knowing why is better.
A plausible number is not enough. Know what produced it, what was lost and what supports its attribution.
[ kernel ]
↓
[ omn ]
↓
[ omn ]
Direct by design.
eBPF, perf_event_open, procfs, sysfs and netlink. No perf, bpftrace or bcc running underneath.
◴ → ◷
Record. Revisit.
Save a run and replay it in the terminal. Change the view, keep the context.
scope: package
target: process
↳ request refused
Honest boundaries.
If a source cannot answer a question, the validator explains why — instead of answering a different one.
YOUR TERMINAL / MORE DIMENSIONS
Same run.
A different perspective.
Select a request and carry its focus across views. Inspect execution lanes or CPU call stacks — all drawn from one recorded run.
● ● ●
omn top / request120 × 40Snapshots of the many-requests fixture from the view gallery, drawn at 120×40 and held by tests/view_snapshots.rs. Colours mapped onto this page's palette.
REPRODUCIBLE INVESTIGATIONS
Trace as code.
Prototype a measurement in the shell, then keep it in a session file. YAML, JSON and TOML describe the same requests. The program is part of the request: launching it makes it both the target and the clock.
Browse the sessions# omn -f examples/mem-rss-run.yml
name: resident memory of a launched program
requests:
- label: rss
source: mem.rss
target:
launch: [python3, -c, "..."]
mode: poll@100ms
emit: [timeline, summary]
keys: [task, cgroup]TESTED WITH DISTROPROOF / OCTOBER 2026
Different kernels.
Explicit limits.
The installed releases were tested on 16 distro images and 5 variants, spanning Linux 4.15 to 7.2, glibc and musl. The same binary listed 36 sources usable on Ubuntu 18.04 and 96 on Fedora — with a reason for each refusal.
Availability checked against reality.
The campaign found 16 defects: 9 in the tool and 7 in its tests. Initially, 158 source runs were listed usable but refused at start. After the fixes, none did. Every refusal reason agreed with envprobe’s independent reading of the same guest across all 21 targets.
Explore the distroproof case study →Features, beyond version numbers.
Real probes catch Debian’s perf policy, BPF maps charged to memlock on 5.10, lockdown restrictions and Alpine’s missing function tracer. RHEL backports are detected as features rather than ruled out by kernel age.
Two release archives.
The glibc archive targets glibc 2.17+. Alpine has a native musl archive with a static engine and a musl preload shim. NVIDIA sources are unavailable in the static build because they need dynamic library loading.
What remains open.
Reference comparisons against distro-packaged perf, bpftrace and other witnesses ran on six distributions; some still differ or skip. Fedora opensnoop and Rocky 9 lock contention remain open. This campaign does not cover aarch64, containers or NixOS.
Read the findings and evidence →OPEN SOURCE / BUILT FOR LINUX
Ask your machine
a better question.
Choose the release for your C library or build from source. Run omn list to see what this machine can serve; eBPF sources need capabilities and suitable kernel settings.
omn top -- ./your-program