Kerno

At a glance

• Editor score
  8.1 / 10
• Pricing
  Open source
• Best for
  Kernel-level incident diagnosis
• Paid from
  Free
• Deployment model
  Self-hosted
• Facts checked
  22 Sep 2026

• Where it wins

  • Ranks causes, evidence, and remediation suggestions in incident reports
  • Collects syscall, TCP, OOM, disk, scheduler, and file-descriptor signals
  • Supports Kubernetes, Prometheus, JSON automation, and real-time tracing

• Where it doesn't

  • Focused on Linux systems rather than cross-platform observability
  • Does not provide application tracing
  • Self-hosted deployment requires infrastructure and operational ownership

Our verdict on Kerno

Kerno is an open-source eBPF incident diagnosis engine for Linux systems and Kubernetes. It is designed for teams investigating kernel-level incidents across Kubernetes DaemonSets, bare-metal hosts, virtual machines, EC2 instances, and GCE instances. Its collection covers syscall latency, TCP retransmits and round-trip time, out-of-memory events, disk I/O latency, scheduler delays, and file-descriptor activity. The result is a focused observability layer for diagnosing system behavior below the application stack.

Kerno’s strongest capability is its diagnosis workflow. The command-line interface produces ranked reports with suspected causes, supporting evidence, and remediation suggestions, while real-time tracing covers syscalls, disk activity, and scheduler behavior. Continuous monitoring is available for TCP, OOM, and file-descriptor signals. Optional AI-powered explanations can enrich kernel error analysis through Anthropic, OpenAI, or Ollama. Teams can also export JSON for CI pipelines and automation, making the product useful when incident response needs machine-readable output as well as human-readable findings.

Deployment and ecosystem fit are centered on self-hosted Linux operations. Kubernetes users can deploy Kerno with Helm or raw manifests, expose Prometheus metrics, and use ServiceMonitor support. Installation paths cover Debian/Ubuntu, RHEL/Fedora, and Amazon Linux 2023 on kernels 5.8+ with BTF; systemd is also supported. This focus suits platform and infrastructure teams that need kernel evidence without adopting a broader application observability suite. Teams primarily seeking application tracing, kernel profiling, or a cross-platform hosted service should choose a tool designed around those requirements instead.

Your product? Our editors can test Kerno in depth and publish a review, labelled as paid · from $149/mo →

Kerno pricing

Kerno fact sheet

Kerno integrations

Kerno lists 6 integrations on its own site.

• Prometheus
• Kubernetes
• Anthropic
• OpenAI
• Ollama
• systemd

Alternatives to Kerno

• CorootBroad eBPF observability with a free edition and $1-per-core Standard pricing.9.3
• DeepFlowA broad open-source platform for application, network, and system observability.9.1
• groundcoverA broad eBPF observability platform for teams connecting traces, RUM, logs, and metrics.9.0

See all Kerno alternatives →

Featured on iTechGuides

Kerno is listed in our eBPF Observability Tools directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/kerno/"><img src="https://www.itechguides.com/best/badge/kerno.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update