eBPF: Revolutionizing Observability and Telemetry for Modern Applications
summary
eBPF runs as a verified virtual machine inside the Linux kernel and is used here to attach kprobes and uprobes to live processes, compile small C/Rust programs, and persist state in maps and ring buffers so traces are offloaded from application threads. Odigos compiles and loads programs, emits OTLP to OpenTelemetry collectors, and reports far lower overhead—eliminating the large 99th‑percentile latency spike that in‑process agents cause. Facebook-level production usage since 2017 shows it works at scale.
AI-written summary · about
chapters (10)
- 0:00eBPF and observability
- 6:41eBPF transforms tracing
- 10:58eBPF program security
- 14:28eBPF for Kubernetes
- 17:17Writing and loading eBPF
- 20:45eBPF for tracing encryption
- 23:57eBPF performance benefits
- 27:04Dynamic instrumentation
- 28:50AI with eBPF
- 30:15Q&A
related talks
31meBPF for Observability: The Good, the Bad, and the Ugly
31mZero instrumentation observability with eBPF
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
32meBPF: The Next Power Tool of SREs
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
43meBPF Superpowers for SRE
32mExploring the Power of eBPF for System Observability
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security