Ozan Sazak won the eBPF Summit '25 Hackathon with xgotop, a tool that gives you near real-time visibility into Go runtime behavior. It hooks directly into Go's internal functions to watch goroutine state changes and memory allocations as they happen. No log statements. No code changes. Just attach and observe.
The trick is hooking functions like runtime.casgstatus (which handles most goroutine state transitions), runtime.newobject, runtime.makeslice, and runtime.makemap. By planting eBPF userspace probes on these functions, xgotop can see when a goroutine shifts from runnable to running, when it parks, when it enters a syscall, when it exits. Sazak walks through the g struct in Go's runtime, showing how goroutines track their own ID, parent ID, and current atomic status.
But this approach has teeth. Hooking high-frequency functions like casgstatus or newobject in a busy production system can swamp the perf ring buffer and spike CPU usage. There's also the stability problem: xgotop reads internal Go structs like g, which means a compiler or runtime update could shift memory offsets and break things. CO-RE (Compile Once, Run Everywhere) can help with portability, but you're still fundamentally attaching uprobes to functions the Go team doesn't consider public API.
The Hacker News crowd drew parallels to DTrace-based approaches for catching goroutine leaks, specifically by watching runtime.newproc1 and runtime.gdestroy. Some noted Go's concurrency model already does a decent job preventing the kind of leaks you'd see with manual thread management. Others wanted to see similar tooling for async Rust.