Noisy Neighbor Detection with eBPF
summary
eBPF instruments the Linux scheduler using sched_wakeup, sched_wakeup_new, sched_switch hooks to timestamp enqueue times in a BPF hashmap and compute per-container runq latency, reading cgroup IDs via kfuncs under RCU and emitting events via a ring buffer with an eBPF rate limiter. User-space Go emits Atlas metrics: runq latency (99th percentile baseline 83.4 µs, spike to 131 ms when a noisy neighbor saturates CPU) plus a preemption counter; measured overhead is under 600 ns per hook, optimizations applied, and an open-source BPFTop tool and a Linux 6.10 kernel patch resulted.
AI-written summary · about
chapters (5)
- 0:00Introduction and background
- 3:45Why eBPF for detection
- 10:08Metrics and noisy neighbors
- 13:40BPF top and optimizations
- 16:34Results and future work
related talks
30mPerformance insights into eBPF step by step
30mScheduling at Scale: eBPF Schedulers with Sched_ext
16mPeeR: First-Class Scheduling for Latency-Critical eBPF Applications
49mNoisy Neighbor Detection: A New OSS Collector
29mRuntime Security at Scale With EBPF: Hybrid Detection and Root Cause…
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
46mReal World Debugging with eBPF
35mPerformance Insights into eBPF Step by Step