XPLOG: A Dynamic Observability Framework for Distributed Sandboxed Microservices
Abstract
Runtime application observability is crucial not only for system provenance but also for the orchestration of deployed microservices in dynamic sandboxed distributed computing environments. Also, log extraction and aggregation in highly distributed and sandboxed environments pose significant challenges, especially when preserving the causal order of the events triggered by different asynchronous microservices running over multiple hosts. However, ensuring causally consistent logging of application events is challenging, although it is vital for continuously tracing and profiling the underlying platform. This paper proposes XPLOG, a scalable, pluggable, easily deployable, and dynamic runtime observability framework for distributed sandboxed computing platforms that leverages the capability of extended Berkeley Packet Filters (eBPF) to intercept system-level events within the host while capturing and amalgamating relevant application and system logs to produce globally causally-consistent log streams. Through qualitative and quantitative analysis, we observe that XPLOG significantly improves log richness with minimum system overhead while preserving the causality of log-generating events across multiple microservices.
Contributors
Overview
Dynamic Observability Framework for Distributed Sandboxed Microservices
How to achieving runtime observability in distributed microservice environments? As capturing and correlating logs across sandboxed hosts while preserving causal relationships among asynchronous events remains a major challenge. The solution is our proposed framework, XPLOG.
Key Contributions
- Developmed of a grey-box observability framework for multi-host sandboxed applications: It’s first-of-its-kind observability framework for sandboxed distributed platforms to monitors containerized microservices running across multiple physical or virtual hosts, generating causally-consistent, context-aware logs without requiring application or platform instrumentation
- Causality-Aware Collation of System and Application Logs: XPLOG uses eBPF ring buffers to develop a method for making the syscalls atomic and preserving causality during the log collection from multiple sandboxed microservices running over multiple hosts
- Implementation and thorough evaluation: We open-source the implementation of XPLOG, evaluate it with a benchmark DeathStarBench social media application with 30 microservices, each with 3–5 replicas, spawning over 10-30 different hosts
- XPLOG significantly improves log richness with minimum system overhead while preserving the causality of log-generating events across multiple microservices
Bibtex
@article{satapathy2025xplog,
title={XPLOG: A Dynamic Observability Framework for Distributed Sandboxed Microservices},
author={Satapathy, Utkalika and Borse, Harsh and Bachhawat, Rajat and Dalmia, Neha and Chattopadhyay, Subhrendu and Chakraborty, Sandip},
journal={IEEE Transactions on Services Computing},
year={2025},
publisher={IEEE}
}
Cite
Satapathy, U., Borse, H., Bachhawat, R., Dalmia, N., Chattopadhyay, S., & Chakraborty, S. (2025). XPLOG: A Dynamic Observability Framework for Distributed Sandboxed Microservices. IEEE Transactions on Services Computing.