Methodology and Practice in Observing Kernel Networking
summary
Tencent builds a continuous, low-overhead observability platform for older kernels (3.10, 4.4) that targets latency as root metric and drills down to actionable children (SKB alloc, TCP RTO behavior). It implements a kernel module with BPF time stamping, ships data via relayfs to user space, and enforces zero code intrusion so apps need no patches. Production runs show acceptable overhead (<2% CPU), catch RTO patterns (RTO min 200 ms, alert spikes >50 ms) and surface fixable causes.
AI-written summary · about
chapters (8)
- 0:00Introduction and motivation
- 1:48Private platform trends
- 3:15Methodology for intended behavior
- 8:31Root latency metrics hierarchy
- 10:45Practice at Tencent
- 12:33BPF time stamping proposal
- 15:24Trace point stability consensus
- 16:10Q&A on root latency
related talks
31mFrom Kernel To Cloud: Building a Complete Open Source Observ...
20mNetwork Monitor: A Tale of ACKnowledging an Observability Gap
31mZero instrumentation observability with eBPF
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
31meBPF for Observability: The Good, the Bad, and the Ugly
37meBPF: Revolutionizing Observability and Telemetry for Modern Applications
24mMaking the Kernel Speak Kubernetes: Unlocking eBPF’s Power for Observability
19mNetwork X-Ray Vision: eBPF for Cloud-Native Observability