Low-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
summary
Explains how eBPF programs compile to kernel bytecode, pass the verifier and run via the JIT to attach to kprobes, uprobes and perf events while aggregating data in kernel BPF maps so users avoid copying raw traces. Demonstrations use the BCC toolchain: func latency and off-CPU flame graph generation from a Postgres load (showing ~200 calls in the 500ns–1ms histogram bucket), TTY snoop to record shell sessions, and an alerting path that makes a phone call; deployment is a privileged pod sharing host PID and kernel symbols.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:43What is eBPF
- 4:49eBPF Tools
- 7:09Use Cases
- 8:41Code Snippet
- 10:11Histogram
- 10:53Flame Graph
- 14:21Demo
- 17:28CPU Time
- 24:21Questions
related talks
38mLinux Kernel Tracing Using eBPF
25mKernel tracing with BPF
38mThe Next Linux Superpower: eBPF Primer
42mKernel Analysis Using eBPF
36mObservability and performance analysis with BPF
29mKubernetes Observability with eBPF
32mExploring the Power of eBPF for System Observability
37meBPF: Revolutionizing Observability and Telemetry for Modern Applications