[syoc]

This presentation should give insight to some of the possibilities of ebpf. Strace is passive, ebpf can be active and make decisions in kernel space.

https://www.usenix.org/conference/nsdi21/presentation/ghigof...

Another example is controlling the scheduler with ebpf.

https://lwn.net/Articles/873244/