Kerno review
Open-source kernel observability for diagnosing Linux and Kubernetes incidents.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Kerno is an open-source eBPF incident diagnosis engine for Linux systems and Kubernetes. It is designed for teams investigating kernel-level incidents across Kubernetes DaemonSets, bare-metal hosts, virtual machines, EC2 instances, and GCE instances. Its collection covers syscall latency, TCP retransmits and round-trip time, out-of-memory events, disk I/O latency, scheduler delays, and file-descriptor activity. The result is a focused observability layer for diagnosing system behavior below the application stack.
Kerno’s strongest capability is its diagnosis workflow. The command-line interface produces ranked reports with suspected causes, supporting evidence, and remediation suggestions, while real-time tracing covers syscalls, disk activity, and scheduler behavior. Continuous monitoring is available for TCP, OOM, and file-descriptor signals. Optional AI-powered explanations can enrich kernel error analysis through Anthropic, OpenAI, or Ollama. Teams can also export JSON for CI pipelines and automation, making the product useful when incident response needs machine-readable output as well as human-readable findings.
Deployment and ecosystem fit are centered on self-hosted Linux operations. Kubernetes users can deploy Kerno with Helm or raw manifests, expose Prometheus metrics, and use ServiceMonitor support. Installation paths cover Debian/Ubuntu, RHEL/Fedora, and Amazon Linux 2023 on kernels 5.8+ with BTF; systemd is also supported. This focus suits platform and infrastructure teams that need kernel evidence without adopting a broader application observability suite. Teams primarily seeking application tracing, kernel profiling, or a cross-platform hosted service should choose a tool designed around those requirements instead.
Kerno pros and cons
- Where it wins
- Ranks causes, evidence, and remediation suggestions in incident reports
- Collects syscall, TCP, OOM, disk, scheduler, and file-descriptor signals
- Supports Kubernetes, Prometheus, JSON automation, and real-time tracing
- Where it doesn't
- Focused on Linux systems rather than cross-platform observability
- Does not provide application tracing
- Self-hosted deployment requires infrastructure and operational ownership
Kerno fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update