Dive into BPF performance tools using python
summary
Demonstrates using the bcc Python frontend to load and run BPF programs on Ubuntu 18.04 (as root) with live coding examples. Covers concrete tools: execsnoop and opensnoop syscall tracing that print execve/open arguments, a histogram example to measure latencies, filtering by PID, measuring syscall frequency and overhead, and packaged scripts for cloning and running; includes real uses such as Kubernetes security tracing and diagnosing a stuck long‑running server.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:06What is BPF
- 4:46BPF as mini-programs
- 7:01BPF tools for devs
- 10:02First BPF with Python
- 11:07Simple BPF demo
- 15:0310 system diagnostics
- 17:33Monitoring syscalls
- 25:21BPF runtime limits
- 27:55BPF helpers and maps
- 28:41Tracking file opens
- 33:16Syscall analysis deep dive
- 35:09BPF use cases
- 37:40BPF for security/networking
- 38:23Why BPF matters
- 40:09Getting started
- 41:56BPF and Python tooling
- 44:03Q&A
related talks
36mObservability and performance analysis with BPF
21mPerformance Wins with BPF: Getting Started
38mLinux Kernel Tracing Using eBPF
32meBPF: The Next Power Tool of SREs
38mThe Next Linux Superpower: eBPF Primer
32mExploring the Power of eBPF for System Observability
32mBPF: Introduction, Programming Tips and Tricks
35mPerformance Insights into eBPF Step by Step