Kernel tracing with BPF
summary
eBPF is used to build live kernel tracers like bio top (BCC Python wrapper plus ~230 lines of code with embedded C) that compiles via LLVM to eBPF bytecode, passes verifier checks, and emits results over per‑CPU perf ring buffers or BPF maps; the same workload reduces to ~30 lines in bpftrace, which exposes ~50,000 kprobes and produces histograms (examples show ~25k–30k calls). Requires root, cannot scope eBPF to namespaces today, and kprobe overhead is roughly ~20 extra instructions plus JIT and cache effects.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:41What is BPF
- 2:31Example
- 3:04Biotop
- 3:42Python Script
- 5:34BPF bytecode
- 7:42Block functions
- 11:00Runtime BPF
- 12:17BPF Choice
- 14:54Results
- 18:34BCC Trace
- 20:42ICMP Trace
related talks
38mLinux Kernel Tracing Using eBPF
42mKernel Analysis Using eBPF
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
38mThe Next Linux Superpower: eBPF Primer
25mAn introduction to bpftrace tracing language
28mbpftrace: what is it, what's new, and where is it going
46mbpftrace internals
36mDebugging with eBPF on Arm Platforms