Fantastic tracepoints and where to find them
summary
Shows how to use only shell tools (cat, echo, trace_pipe) then add perf and BPF to inspect kernel activity, noting ~1,600–2,000 static tracepoints available on modern kernels. Demonstrates filtering regmap and i2c events to find a noisy adapter, uses kprobes/perf probe to extract VFS arguments, and builds a working ply BPF leak detector that maps allocations to stacks and reports leaks (and in-flight allocations) in real time.
AI-written summary · about
chapters (5)
related talks
55mLinux Kernel Debug And Profiling Tools
55mRecent Advances in Linux Tracing
25mAn introduction to bpftrace tracing language
38mLinux Kernel Tracing Using eBPF
36mObservability and performance analysis with BPF
34mTracing: The Bane of You Security Folks
36mDebugging with eBPF on Arm Platforms
36mDebugging with eBPF on Arm Platforms