Tracing Go Programs with eBPF!
summary
Builds a Go tracer that compiles and loads small eBPF C snippets via BCC, attaches an uprobe + bcc to a Go symbol (e.g. main.handler), and streams events back over a perf buffer into a Go channel. Shows use of bpf_probe_read to reconstruct Go stack-based arguments (example: addTwoNumbers(42,3)) and bpf_probe_write_user to mutate an argument in flight, changing the observed result. Requires sudo, demos both logging and fault injection and the prototype works end-to-end.
AI-written summary · about
chapters (5)
- 0:00Start
- 0:06Tracing Go Programs with eBPF!
- 3:23What is tracing? By using many features of the operating system we can inspect the activity of running programs We can make sure programs are doing what they say they're doing We can see why programs aren't working properly. We can monitor performance
- 7:34eBPF is used to build tracing tools - A virtual machine that runs inside the Linux kernel Let's you write C code which is executed when triggered by events. You can define the event triegers - system calls being executed network packets arriving functions in programs being run.
- 34:47Tracing Go function arguments - When switching contexts between different functions, the Go runtime will place arguments at offsets from the top of the stack based on their size and order in the list of arguments
