I remember looking at some internals on Solaris with dtrace, I think eBPF would be an equally good tool for doing that on Linux, it's mentionned at the end of the article but I fail to see why would drgn be better.