The Next Linux Superpower: eBPF Primer
summary
Kernel-side programmable tracing with eBPF plus the bcc front end compiles C into safe bytecode, JITs it, and attaches to kprobes, uprobes and tracepoints; examples include hardirqs, biolatency, filetop and stackcount. A demo builds a kernel probe that increments a switch_counts hash table (showing 40 switches between pid 0 and 703) and a kmalloc counter used to find real memory leaks. Requires root, needs Linux 4.4–4.7+ for some features, and uses Python/libbcc or a static bcc-lua binary for deployment.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:31Agenda
- 2:20Tracing Tools
- 4:03eBPF
- 8:14BPCC
- 9:07Tools
- 10:43HardIRQs
- 11:54FileTop
- 12:45StackCount
- 13:45Tracing targets
- 16:39Arc dist
- 18:08Argist
- 19:14Trace
- 21:00Pthread
- 23:08Building Your Own Tools
- 32:35Deployment
- 34:20Summary
related talks
38mLinux Kernel Tracing Using eBPF
25mKernel tracing with BPF
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
42mKernel Analysis Using eBPF
32meBPF: The Next Power Tool of SREs
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
32mExploring the Power of eBPF for System Observability
16mWhy Everyone Should Care About eBPF