Observability and performance analysis with BPF
summary
BPF runs a safe VM inside the Linux kernel so userspace tools can compile and load probes that the verifier guarantees will terminate and not crash the system; the demo uses bpftrace and the BCC toolkit to attach to exec and tracepoints, capture kernel and user stacks, and produce on‑CPU and off‑CPU flame graphs. Profiling a docker pull shows unexpected background git execs and kernel VFS copy work; the technique successfully reveals I/O wait vs CPU hot spots.
AI-written summary · about
chapters (12)
- 0:00Introduction to observability
- 3:23Black Swan events and robustness
- 5:23What is BPF
- 7:30How BPF programs work
- 12:30BPF Trace examples
- 19:18Performance analysis basics
- 20:52CPU flame graphs
- 23:01Profiling Docker with BPF
- 27:11Generating flame graphs
- 30:17Off-CPU flame graphs
- 33:09Combining CPU and off-CPU data
- 34:19BPF as enabling technology
related talks
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
21mPerformance Wins with BPF: Getting Started
38mLinux Kernel Tracing Using eBPF
47mDive into BPF performance tools using python
42mKernel Analysis Using eBPF
42mResolving Performance and Security Issues with eBPF
25mKernel tracing with BPF
38meBPF for Observability: Hard Truths and Practical Wins