An introduction to bpftrace tracing language
summary
Introduces practical bpftrace usage with concrete examples: tracing the read syscall via kprobes and uprobes, building per-program associative maps (counts, histograms) using built-ins like @count, @hist and computing latency by storing timestamps on entry and subtracting on exit, printing kernel stack traces and symbolizing addresses, and filtering by command name. Scripts run without changing target binaries, output prints to the bpftrace process terminal, and the workflow requires a relatively recent Linux kernel with eBPF; includes bpftrace one-liners and file-script usage.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:13What is bpf
- 1:56Why use bpf
- 3:48Example
- 6:36Probes
- 10:30Building variables
- 11:31Functions
- 12:25Other functions
- 13:25Combining functions
- 14:08Filters
- 14:45Time
- 15:55Structure member
- 17:39Scene printf
related talks
28mbpftrace: what is it, what's new, and where is it going
38mLinux Kernel Tracing Using eBPF
25mKernel tracing with BPF
35mbpftrace: Evolution from a command line tool to a complex observability framework
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
36mObservability and performance analysis with BPF
34mWhat's new in the BPF world?
38mThe Next Linux Superpower: eBPF Primer