Linux Kernel Tracing Using eBPF
summary
eBPF loads verified bytecode into the kernel to attach to syscalls and probes with minimal overhead and a verifier that prevents unsafe programs, and the talk shows practical use of BCC (Python) and bpftrace for live inspection. Demonstrations include opensnoop and execsnoop to list files and execs, tcpconnect to capture source/dest IPs and ports, and funccount/trace for ICMP and scheduler events; maps aggregate counts (example: process syscall counts) and a 5.4 kernel exposes >1500 tracepoints.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 0:36What is eBPF
- 1:50Components of eBPF
- 3:12User Space vs Corner Space
- 7:34eBPF Tools
- 10:50eBPF Tracing
- 12:20Dynamic and Static Instrumentation
- 13:48Current Instrumentation
- 15:09BCC Tools
- 19:53eBPF Demo
- 23:25eBPF Count
- 25:22Schedule Proof
- 27:42TCP Connect
- 29:12Function Tools
- 31:21Trace Command
- 35:34Memory Leak
related talks
25mKernel tracing with BPF
38mThe Next Linux Superpower: eBPF Primer
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
42mKernel Analysis Using eBPF
16mWhy Everyone Should Care About eBPF
28mbpftrace: what is it, what's new, and where is it going
25mAn introduction to bpftrace tracing language
42mResolving Performance and Security Issues with eBPF