diff --git a/observation/src/biotop/biotop.bpf.c b/observation/src/biotop/biotop.bpf.c
index 8d79e3d94732f2c022c4df49fcc991c63c9b88a5..470e64117dcf837472ec1f76b6167fdeba0fe4f1 100644
--- a/observation/src/biotop/biotop.bpf.c
+++ b/observation/src/biotop/biotop.bpf.c
@@ -30,4 +30,17 @@ struct {
 	__type(value, struct val_t);
 } counts SEC(".maps");
 
+SEC("kprobe")
+int BPF_KPROBE(blk_account_io_start, struct request *req)
+{
+	struct who_t who = {};
+
+	/* cache PID and comm by request */
+	bpf_get_current_comm(&who.name, sizeof(who.name));
+	who.pid = bpf_get_current_pid_tgid() >> 32;
+	bpf_map_update_elem(&whobyreq, &req, &who, BPF_ANY);
+
+	return 0;
+}
+
 char LICENSE[] SEC("license") = "GPL";