I was going to say the same thing.

I really like the eBPF approach as pointed out to by the other comments. I feel like this is the ideal approach, please correct me if I'm wrong.

A callback based approach as opposed to (constantly) polling the output of some command is ideal.