In the process of reading a file, the CPU execution context will switch from executing a user program to the kernel code.The overhead in context switching from user to kernel mode is relatively nominal compared to a context switch between two different processes.Kernel memory space can only be accessed in the kernel mode.Frequent mode switches can still affect a system’s overall performance.When the number of user kernel mode switches increased, it affected the performance of the data store application running on the servers.To solve the problem, they had to monitor file changes from kernel space using an eBPF program.eBPF runs inside the kernel to monitor file changes by attaching it to the file change syscalls, such as write.This new solution no longer affected the performance of the data store server.Understanding OS internals can help troubleshoot rare occurrences.Learning about nitty-gritty OS internal details can be helpful in rare troubleshooting scenarios.