[Varriount]

Huh, is TLS being handled in the kernel these days? I thought most systems still used usermode libraries.

[ev_dev3]

I'm using the term "low level system calls" loosely here since the poster asked for ELI5. Trayce actually uses a combination of kprobes for system calls and uprobes to monitor calls to OpenSSL or the Go crypto/tls package. More details are here: https://github.com/evanrolfe/trayce_agent/blob/main/docs/REA...