coroot

Identify and analyze kernel-level incidents using Coroot observability data.

387|68|Updated Jan 22, 2026
One-click install
npx skills add https://github.com/Arvo-AI/aurora --skill coroot
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: coroot
Source: https://github.com/Arvo-AI/aurora/tree/main/server/chat/backend/agent/skills/integrations/coroot
Command: npx skills add https://github.com/Arvo-AI/aurora --skill coroot

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Coroot provides kernel-level observability to capture data that application-level metrics and logs miss, enabling accurate incident RCA, root-cause analysis, and risk assessment across complex infrastructures.

Core Features & Use Cases

  • eBPF-powered data collection: captures kernel-level metrics including TCP connections, DNS queries, disk I/O, and per-container resource usage.
  • Service map and topology, incident RCA: builds a live view of dependencies and enables end-to-end RCA across services, deployments, and nodes.
  • Traces, logs, and costs/risk insights: correlates traces with logs and computes cost and risk signals for informed remediation.
  • Use Case: during a cloud incident, correlate kernel-level events with application logs to determine if the root cause is a resource contention or a failed dependency.

Quick Start

Run coroot_get_incidents to fetch recent incidents and review their RCA summaries.

Frequently Asked Questions about coroot

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How does eBPF kernel-level observability help with incident root cause analysis?▼

eBPF kernel-level observability captures TCP connections, DNS queries, and disk I/O that application-level metrics miss, providing accurate incident root cause analysis across complex infrastructures.

How do I investigate cloud incidents using kernel-level traces and logs?▼

To investigate cloud incidents, run coroot_get_incidents to fetch recent incidents. This correlates kernel-level events with application logs to determine if root causes are resource contention or failed dependencies.

Can I perform cross-cluster incident investigation and cross-resource correlation?▼

Yes, cross-cluster incident investigation applies across clusters for RCA detail and cross-resource correlation. Connectivity checks are required before querying data sources to fetch accurate incident summaries.

What is the best way to correlate traces with logs for cost and risk assessment?▼

The best way to correlate traces with logs for cost and risk assessment is using eBPF-powered data collection, which computes cost and risk signals for informed remediation across services and deployments.

Why do application-level metrics and logs miss infrastructure-level root causes?▼

Application-level metrics and logs miss root causes because they lack kernel-level visibility. eBPF captures per-container resource usage and dependencies, building a live service map to reveal resource contention issues.

Do I need specific tools or connectivity checks before fetching incident RCA summaries?▼

Yes, you need the coroot tools listed in the metadata and must pass connectivity checks before querying data sources to successfully fetch incident RCA summaries and review them.