eHashPipe: Lightweight Top-K and Per-PID Resource Monitoring with eBPF

System-level resource monitoring with both precision and efficiency is a continuous challenge. We introduce eHashPipe, a lightweight, real-time resource observability system utilizing eBPF and the HashPipe sketching algorithm. eHashPipe supports two tracking modes: Top-k monitoring to identify the most resource-demanding processes and specific PID tracking to detail the behavior of selected processes. We implement two in-kernel eBPF pipelines for on-CPU time and memory usage. Unlike traditional userspace polling tools, eHashPipe operates in the kernel to reduce latency and context-switch overhead while keeping the runtime footprint small. During our experiments, eHashPipe attains 100% Top-k precision for CPU and memory at k ∈ {1,5,10}, 95.0%/90.0% at k = 20, and 93.3%/83.3% at k = 30 compared to the ground truth. It exposes shortlived bursts with about 14× finer temporal resolution than top while imposing very low overhead. These results show that eHashPipe delivers accurate, responsive insight with minimal impact, making it well suited for latency-sensitive cloud and edge environments.