商业产业 Hacker News AI 2026-08-21T15:21 正文 ok 1313 words

Show HN：AgentSight——基于 eBPF 的 AI Agent 可观测性，无需修改代码

英文标题：🔶 Show HN: AgentSight – eBPF observability for AI agents, no code changes

AgentSight 是一款面向 Linux 上 AI Agent 的零侵入可观测性工具，利用 eBPF 在内核层捕获 LLM API 调用、Token 消耗和进程行为，无需修改 Agent 代码。它提供 Token 多维统计、LLM 调用与进程审计、Agent 自动发现、会话中断检测以及实时 Dashboard，并可导出结构化日志。该工具要求 Linux 内核 5.8 及以上、BTF 支持以及 root 或 CAP_BPF 权限，适合需要统一监控生产环境 AI Agent 运行状态的开发者和平台团队。AgentSight 还支持 Tokenless 节省数据展示，并提供针对 OpenClaw 等场景的排障说明。

打开原文相关 3 · 机会 1

78.9 KB

中文

AgentSight 是一款基于 eBPF 的零插桩 AI Agent 可观测性工具。它无需修改 Agent 代码，即可在内核层捕获 LLM API 调用、Token 消耗和进程行为。

AgentSight 为运行在 Linux 上的 AI Agent 提供全栈可观测性：

能力	说明
Token 消耗分析	按 Agent、任务和模型进行多维 Token 核算
行为审计	完整追踪 LLM 调用和进程执行
Dashboard 可视化	用于实时查看 Token 趋势、Agent 健康状态和会话追踪的 Web UI
Agent 自动发现	自动检测正在运行的 AI Agent 进程
中断检测	检测 LLM 错误、SSE 截断、上下文溢出和崩溃
外部日志导出	支持将结构化事件导出至外部日志服务

要求	最低配置
操作系统	Linux
内核	>= 5.8（需要 BTF 支持）
权限	root 或 CAP_BPF（用于 eBPF 探针）
ANOLISA 原始包	Linux x86_64，系统模式

macOS：在 macOS 上，AgentSight 提供两个命令：trace（轨迹采集器，扫描本地 JSONL 会话文件，不使用 eBPF）和 serve（Dashboard 查看器）。其他所有依赖 eBPF 的命令仅支持 Linux。

使用 ANOLISA CLI 安装已发布组件：

# 推荐方式（需要系统模式——eBPF 需要 root 权限）
sudo anolisa install agentsight

# 备选方式（Alinux，需要配置 YUM 仓库）
sudo yum install agentsight

# 源码构建（仅面向开发者）
cd src/agentsight && make build-all

使用 make build-all 进行源码构建：它会依次构建 Dashboard 前端、主二进制文件和 agentsight-enforcer。如果只运行 make build，会跳过 enforcer，serve 将持续记录 AgentSight enforcement unavailable 日志。

正常部署请使用 systemd 单元。它会同时运行 eBPF 追踪和 Dashboard，并按所需顺序启动 enforcer 依赖：

sudo systemctl enable --now agentsight.service
sudo systemctl status agentsight.service

服务激活后，打开 http://localhost:7396。启用主单元后，AgentSight 在重启系统后仍会保持可用。

随附的 systemd 启动器会将 Dashboard 绑定到 0.0.0.0。在将主机暴露给不受信任的网络之前，请使用防火墙或安全组限制 7396 端口。

该服务以 root 身份运行，使用私有 umask，并将数据存储在 /var/log/sysak/.agentsight 下。对于读取这些由服务拥有的数据的 CLI 查询和 Dashboard 访问命令，请使用 sudo。

如需进行前台故障排查，请先停止 systemd 单元，避免其与第二个追踪器竞争。随后使用两个终端，并以 root 身份运行两个命令。如果按顺序在同一个终端中输入，第二个命令不会执行，因为 agentsight trace 会保持在前台运行：

sudo systemctl stop agentsight.service

# 终端 1
sudo agentsight trace

# 终端 2：启动 Dashboard
sudo agentsight serve
# 在浏览器中打开 http://localhost:7396

# 打印 Dashboard URL 和 Token；请以桌面用户身份打开该 URL
sudo agentsight dashboard --no-open

本地主机访问无需认证；远程访问需要 Token，详见“Dashboard 访问与认证”。

agentsight trace — 启动 eBPF 追踪

启动对 AI Agent 活动的内核级捕获。

需要 root 权限。会捕获 SSL/TLS 流量、进程事件和文件操作。在启动前台追踪器之前，请运行 sudo systemctl stop agentsight.service。

agentsight serve — 启动 API 与 Dashboard

# 默认：绑定到 127.0.0.1:7396
sudo agentsight serve

# 绑定到全部网络接口（远程访问）
sudo agentsight serve --host 0.0.0.0 --port 7396

请以运行 trace 的同一用户运行 serve，以确保两个命令解析到相同的数据目录。绑定到 0.0.0.0 会将 Dashboard 暴露在所有网络接口上；使用此形式前请限制网络访问。

Dashboard 访问与认证

Dashboard Token 认证默认启用：

本地主机访问（回环地址）会绕过认证——直接打开 http://127.0.0.1:7396。
远程访问需要 Token：在浏览器 URL 后附加 ?token=<TOKEN>，或设置 Authorization: Bearer <TOKEN> HTTP 请求头。
Token 会在首次启动 serve 时自动生成（64 个十六进制字符），并持久化保存到数据库旁的 .dashboard_token 文件中（默认位置为 /var/log/sysak/.agentsight/.dashboard_token）；重启后会复用该 Token。
运行 sudo agentsight dashboard --no-open，即可打印由服务拥有的访问 URL 和 Token，再以桌面用户身份打开该 URL。

如需禁用认证（仅建议在可信内部网络中使用），请在配置文件中设置：

{
  "server": { "auth": { "enabled": false } }
}

编辑 /etc/agentsight/config.json 后，运行 sudo systemctl reload agentsight.service 应用变更——无需执行 restart。

GET /api/docs 会返回完整的 API 路由清单（方法、路径、说明），以便脚本和集成自动发现端点；对于未知的 /api/ 路径，请求返回的 404 响应也会指向该地址。

curl http://127.0.0.1:7396/api/docs

agentsight dashboard — 显示 Dashboard 访问信息

显示 Dashboard URL 和认证 Token，然后尝试打开浏览器。在 ECS 实例上，它还会打印安全组配置指南。

# 显示 URL 和 Token，但不打开由 root 拥有的浏览器
sudo agentsight dashboard --no-open

agentsight summary — 统一概览

汇总近期时间窗口内的会话和 Token 使用量、按严重程度分组的中断事件以及 Tokenless 节省情况——通过一条命令获取整体健康状态。

# 最近 24 小时（默认）
agentsight summary

# 最近 7 天，JSON 输出
agentsight summary --last 168 --json

各数据源会独立降级：缺失的数据库仅会贡献零值，不会影响报告的其余部分。

agentsight token — 查询 Token 使用量

# 今日使用量
sudo agentsight token

# 每周对比
sudo agentsight token --period week --compare

# JSON 输出
sudo agentsight token --json

agentsight audit — 查询审计事件

# 最近事件
agentsight audit

# 按 PID 和类型过滤
agentsight audit --pid 12345 --type llm

# 汇总统计
agentsight audit --summary

agentsight discover — 扫描 Agent

# 发现正在运行的 AI Agent
agentsight discover

# 列出已知 Agent 类型
agentsight discover --list-known

agentsight interruption — 会话中断事件

查询和管理 AI Agent 会话中断事件。

中断类型：

类型	说明	默认严重程度
`llm_error`	HTTP 状态码 >= 400，或 SSE 正文包含错误	高
`sse_truncated`	SSE 流在未出现 `finish_reason=stop` 的情况下结束	高
`context_overflow`	超出上下文长度	高
`agent_crash`	Agent 进程在会话中途消失	严重
`token_limit`	`finish_reason=length`，且输出接近最大值	中等

# 列出中断事件（默认：最近 24 小时）
agentsight interruption list [--last <HOURS>] [--type <TYPE>] [--severity <LEVEL>]

# 按类型统计
agentsight interruption stats

# 按严重程度计数
agentsight interruption count

# 按 ID 获取单个事件
agentsight interruption get <ID>

# 列出某个会话 / 对话的全部中断事件
agentsight interruption session <SESSION_ID>
agentsight interruption conversation <CONVERSATION_ID>

# 标记为已解决
agentsight interruption resolve <ID>

配置文件：/etc/agentsight/config.json（可通过 --config 覆盖）。

重要提示：用户配置文件会替换（而不是扩展）内置默认规则。请确保配置中包含所需的全部 Agent 规则。

功能	JSON 路径	默认值	说明
Token 统计	`features.token_stats`	`true`	核心 Token 核算
SQLite 存储	`features.sqlite_storage.enabled`	`true`	本地持久化
中断检测	`features.interruption_detection.enabled`	`true`	错误/崩溃检测
审计	`features.audit`	`true`	LLM 调用审计
会话映射	`features.session_mapping.enabled`	`true`	responseId→sessionId

配置项	默认值	说明
`event_channel_capacity`	10,000	探针事件有界通道容量
`pending_genai_max_count`	1,000	等待 session_id 的最大事件数
`max_connection_body_mb`	8	单个 HTTP 连接正文缓冲区大小上限
`ring_buffer_mb`	32	eBPF Ring Buffer 大小（必须是 2 的幂）

Agent 框架集成

对话技能（cosh）

AgentSight 为 Copilot Shell 提供了内置对话技能。用户可以通过自然语言查询 Token 用量和审计日志：

“我今天使用了多少 Token？”
“显示我今天的 LLM 调用记录”

Token 节省（Tokenless 集成）

AgentSight 与 Tokenless 组件集成，可在 Dashboard 中显示 Token 节省数据。无需额外配置——如果二者均已安装，节省数据会自动出现。

默认数据库最大容量为 200 MB。达到上限时会触发自动清理。

通过环境变量自定义：

export AGENTSIGHT_GENAI_DB_MAX_SIZE_MB=500


rm -rf /var/log/sysak/.agentsight
# 然后重启 AgentSight

问：为什么看不到 OpenClaw 的 Token 数据？

答：AgentSight 监控的是 openclaw-gateway 守护进程。请检查客户端与网关的连接。如果出现“pairing required”错误，请运行 openclaw devices approve。

问：为什么 Token 节省页面显示为 0？

答：可能原因包括：(1) 尚不支持 AK/SK 认证模式；(2) Session ID 格式不是标准 UUID。

问：为什么累计节省量超过单次调用的差额？

答：Agent 会在上下文中包含历史消息。节省量会跨轮次累积，因此累计节省量会超过每轮之间的差额。

English / 原文

AgentSight is a zero-instrumentation AI Agent observability tool based on eBPF. It captures LLM API calls, Token consumption, and process behavior at the kernel level without modifying Agent code.

AgentSight provides full-stack observability for AI Agents running on Linux:

Capability	Description
Token consumption analysis	Multi-dimensional Token accounting by agent, task, and model
Behavior audit	Complete tracing of LLM calls and process execution
Dashboard visualization	Web UI for real-time Token trends, Agent health, and session traces
Agent auto-discovery	Automatic detection of running AI Agent processes
Interruption detection	Detection of LLM errors, SSE truncation, context overflow, and crashes
External log export	Supports exporting structured events to external log services
Requirement	Minimum
---	---
OS	Linux
Kernel	>= 5.8 (BTF support required)
Privileges	root or CAP_BPF (for eBPF probes)
ANOLISA raw package	Linux x86_64, system mode

macOS : On macOS, AgentSight provides two commands — trace (trajectory collector that scans local JSONL session files, no eBPF) and serve (Dashboard viewer). All other eBPF-dependent commands are Linux-only.

Install the published component with the ANOLISA CLI:

# Recommended (system mode required — eBPF needs root)
sudo anolisa install agentsight

# Alternative (Alinux, requires YUM repo configuration)
sudo yum install agentsight

# Source build (developers only)
cd src/agentsight && make build-all

Use make build-all for source builds: it builds the Dashboard frontend, the main binary, and agentsight-enforcer in sequence. Running only make build skips the enforcer, and serve will keep logging AgentSight enforcement unavailable.

Use the systemd unit for a normal deployment. It runs eBPF tracing and the Dashboard together and starts the enforcer dependency in the required order:

sudo systemctl enable --now agentsight.service
sudo systemctl status agentsight.service

Open http://localhost:7396 after the service becomes active. Enabling the main unit also keeps AgentSight available after a reboot.

The bundled systemd launcher binds the Dashboard to 0.0.0.0. Restrict port 7396 with a firewall or security group before exposing the host to an untrusted network.

The service runs as root with a private umask and stores data under /var/log/sysak/.agentsight. Use sudo for CLI queries and Dashboard access commands that read this service-owned data.

For foreground troubleshooting, stop the systemd unit first so it does not compete with a second tracer. Then use two terminals and run both commands as root. The second command is not reached if both are entered sequentially because agentsight trace stays in the foreground:

sudo systemctl stop agentsight.service

# Terminal 1
sudo agentsight trace

# Terminal 2: Start Dashboard
sudo agentsight serve
# Open http://localhost:7396 in browser

# Print the Dashboard URL and token; open the URL as your desktop user
sudo agentsight dashboard --no-open

Localhost access is authentication-free; remote access requires a token, see Dashboard Access & Authentication.

agentsight trace — Start eBPF Tracing

Starts kernel-level capture of AI Agent activity.

Requires root privileges. Captures SSL/TLS traffic, process events, and file operations. Run sudo systemctl stop agentsight.service before starting a foreground tracer.

agentsight serve — Start API & Dashboard

# Default: bind to 127.0.0.1:7396
sudo agentsight serve

# Bind to all interfaces (remote access)
sudo agentsight serve --host 0.0.0.0 --port 7396

Run serve as the same user that runs trace so both commands resolve the same data directory. Binding to 0.0.0.0 exposes the Dashboard on every interface; restrict network access before using that form.

Dashboard Access & Authentication

Dashboard token authentication is enabled by default:

Localhost access (loopback) bypasses authentication — just open http://127.0.0.1:7396.
Remote access requires a token: append ?token=<TOKEN> to the browser URL, or set the Authorization: Bearer <TOKEN> HTTP header.
The token is auto-generated on the first serve startup (64 hex characters) and persisted to the .dashboard_token file next to the database (default /var/log/sysak/.agentsight/.dashboard_token); it is reused across restarts.
Run sudo agentsight dashboard --no-open to print the service-owned access URL and token, then open the URL as your desktop user.

To disable authentication (only recommended on trusted internal networks), set in the config file:

{
  "server": { "auth": { "enabled": false } }
}

After editing /etc/agentsight/config.json, run sudo systemctl reload agentsight.service to apply the change — no restart needed.

GET /api/docs returns the full API route inventory (method, path, description) so scripts and integrations can discover endpoints; requests to unknown /api/ paths also point to it in the 404 response.

curl http://127.0.0.1:7396/api/docs

agentsight dashboard — Show Dashboard Access Info

Displays the Dashboard URL and auth token, then tries to open a browser. On ECS instances it also prints a security-group configuration guide.

# Show URL and token without opening a root-owned browser
sudo agentsight dashboard --no-open

agentsight summary — Unified Overview

Rolls up sessions and Token usage, interruption events grouped by severity, and Tokenless savings for a recent time window — one command for the overall health picture.

# Last 24 hours (default)
agentsight summary

# Last 7 days, JSON output
agentsight summary --last 168 --json

Data sources degrade independently: a missing database contributes zeros without affecting the rest of the report.

agentsight token — Query Token Usage

# Today's usage
sudo agentsight token

# Weekly comparison
sudo agentsight token --period week --compare

# JSON output
sudo agentsight token --json

agentsight audit — Query Audit Events

# Recent events
agentsight audit

# Filter by PID and type
agentsight audit --pid 12345 --type llm

# Summary statistics
agentsight audit --summary

agentsight discover — Scan for Agents

# Discover running AI Agents
agentsight discover

# List known Agent types
agentsight discover --list-known

agentsight interruption — Session Interruption Events

Query and manage AI Agent session interruption events.

Interruption types:

Type	Description	Default Severity
`llm_error`	HTTP status >= 400 or SSE body contains error	high
`sse_truncated`	SSE stream ended without `finish_reason=stop`	high
`context_overflow`	Context length exceeded	high
`agent_crash`	Agent process disappeared mid-session	critical
`token_limit`	`finish_reason=length` with output near max	medium

# List interruption events (default: last 24h)
agentsight interruption list [--last <HOURS>] [--type <TYPE>] [--severity <LEVEL>]

# Statistics by type
agentsight interruption stats

# Count by severity
agentsight interruption count

# Get a single event by ID
agentsight interruption get <ID>

# List all interruption events of a session / conversation
agentsight interruption session <SESSION_ID>
agentsight interruption conversation <CONVERSATION_ID>

# Mark as resolved
agentsight interruption resolve <ID>

Configuration file: /etc/agentsight/config.json (override with --config).

Important : User config files replace (not extend) the built-in default rules. Ensure your config includes all Agent rules you need.

Feature	JSON Path	Default	Description
Token stats	`features.token_stats`	`true`	Core Token accounting
SQLite storage	`features.sqlite_storage.enabled`	`true`	Local persistence
Interruption detection	`features.interruption_detection.enabled`	`true`	Error/crash detection
Audit	`features.audit`	`true`	LLM call audit
Session mapping	`features.session_mapping.enabled`	`true`	responseId→sessionId
Config	Default	Description
---	---	---
`event_channel_capacity`	10,000	Probe event bounded channel capacity
`pending_genai_max_count`	1,000	Max events awaiting session_id
`max_connection_body_mb`	8	Single HTTP connection body buffer limit
`ring_buffer_mb`	32	eBPF Ring Buffer size (must be power of 2)

Agent Framework Integration

Conversational Skill (cosh)

AgentSight provides a built-in conversational skill for Copilot Shell. Users can query Token usage and audit logs via natural language:

"How much Token did I use today?"
"Show me today's LLM call records"

Token Savings (Tokenless Integration)

AgentSight integrates with the Tokenless component to display Token savings data in the Dashboard. No additional configuration needed — if both are installed, savings data appears automatically.

Default maximum database size: 200 MB. When reached, automatic cleanup triggers.

Customize via environment variable:

export AGENTSIGHT_GENAI_DB_MAX_SIZE_MB=500


rm -rf /var/log/sysak/.agentsight
# Then restart AgentSight

Q: Why can't I see Token data for OpenClaw?

A: AgentSight monitors the openclaw-gateway daemon. Check client-gateway connectivity. If you see "pairing required" errors, run openclaw devices approve.

Q: Why does the Token savings page show 0?

A: Possible causes: (1) The AK/SK authentication mode is not yet supported; (2) Session ID format is non-standard UUID.

Q: Why do cumulative savings exceed the single-call difference?

A: Agents include historical messages in context. Savings accumulate across turns, so cumulative savings exceed per-turn differences.