bpftrace: Evolution from a command line tool to a complex observability framework
summary
bpftrace moves from quick one‑liners to a maintainable observability language: started in 2016, GitHub shows only ~10k unique lines so far but new features change that—hygienic macros for local reusable code, file imports for composability, and C interoperability that compiles small clang objects and links them so kernel helpers can be used. compile‑time introspection and type checks enable cross‑arch scripts and long‑running programs; a standard library, website and browser playground are live and the escape‑hatch C glue already works.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:24BPF trace evolution
- 3:13What is eBPF
- 5:01Origins of BPF trace
- 7:51BPF trace one-liners
- 11:42BPF trace limitations
- 14:53Developer struggles
- 18:21Evolution into a full programming language
- 20:52Macros and reuse
- 21:35C interoperability
- 23:21Compile-time introspection
- 26:40BPF trace benefits
- 27:43BPF trace use cases
- 29:51BPF trace 1.0 roadmap
- 30:36Resources and community
- 31:02Q&A
related talks
22mFrom Tool To ToolBox: How bpftrace is evolving to become more composa...
28mbpftrace: what is it, what's new, and where is it going
25mAn introduction to bpftrace tracing language
35mImproving Bpftrace Reliability
46mbpftrace internals
25mKernel tracing with BPF
36mObservability and performance analysis with BPF
31meBPF for Observability: The Good, the Bad, and the Ugly