Zero instrumentation observability with eBPF
summary
Shows how eBPF attaches tiny programs to kprobes, uprobes and tracepoints to gather metrics, logs, traces and CPU profiles without app instrumentation, and demonstrates a working node agent (karut/kot) that auto-discovers log files, reconstructs OpenTelemetry-like spans, and sends metrics to Prometheus and ClickHouse. Claims low overhead for always-on profiling, gives examples like correlating TCP retransmits to request latency and sampling ~3,000 metrics/sec on a small VM, and shows the approach successfully finds hidden cross-service calls.
AI-written summary · about
chapters (15)
- 0:00Introduction to talk
- 1:08What is observability
- 2:54Modern app complexity
- 4:44Observability pillars
- 10:48Instrumentation challenges
- 15:07Zero-instrumentation eBPF
- 16:11How eBPF works
- 19:46eBPF observability tools
- 20:07Karat’s eBPF use
- 23:41eBPF performance impact
- 25:07eBPF data insights
- 26:56CPU profiling with eBPF
- 28:21OpenTelemetry integration
- 29:28Future of eBPF observability
- 30:13Q&A
related talks
37mZero-instrumentation observability based on eBPF
37meBPF: Revolutionizing Observability and Telemetry for Modern Applications
30mAgentless instrumentation with eBPF, Prometheus and OpenTelemetry
31meBPF for Observability: The Good, the Bad, and the Ugly
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
34mNetwork Observability with eBPF and OpenTelemetry
35mAn Exemplary Path: Leveraging EBPFs and OpenTelemetry To Auto-instrument for Exemplars
27mStep By Step Kubernetes Observability with eBPF