News for hackers. Stuff that matters.
Re:Dtrace for Linux by nailer on Wednesday February 14, 2018 @01:00PM (#16377757)
IIRC one of the big things about dtrace vs systemtap is that dtrace could trace a process from userspace to kernel space and then back again. Can eBPF do this? How else do they compare?
Re:Dtrace for Linux by brendangregg on Wednesday February 14, 2018 @01:12PM (#16377856)
That would not be recalling correctly: SystemTap does that, and so does eBPF (via uprobes and kprobes).

A large problem with SystemTap is that it was developed in the open, and in the early days people were scared off with its kernel panics. SystemTap built a negative brand: first impressions matter. DTrace, however, was largely built before its public release, and with the help from many other engineers and test teams. People's first impressions with DTrace was something that was already awesome. Of course, there are other problems with SystemTap: its process of compiling code and loading kernel modules was always risker than an interpreter.

As for how eBPF compares: I summarized it last year http://www.brendangregg.com/blog/2016-10-27/dtrace-for-linux...

Re:Dtrace for Linux by fche on Wednesday February 14, 2018 @01:57PM (#16378256)
> and in the early days people were scared off with its kernel panics.

It is ironic that to this day those kernel panics are associated with systemtap (the visible user interface) rather than the kernel (where the vast majority of the responsible bugs actually lay). But perceptions indeed matter, even erroneous ones.

Re:Dtrace for Linux by fche on Wednesday February 14, 2018 @01:48PM (#16378170)
Note for freshness that systemtap can also emit eBPF directly now. So kernel modules are the fastest & most powerful way, but not the only one.
Re:Dtrace for Linux by nailer on Wednesday February 14, 2018 @04:47PM (#16379761)
Thanks. How does the stap language being compiled into kernel modules differ from an interpreter? Both seem to have a limited surface (unless you're doing C directly in systemtap)
Re:Dtrace for Linux by abusque on Wednesday February 14, 2018 @09:05PM (#16381399)
An option for correlated kernel and userspace tracing on Linux is LTTng. [0] For a comparison of LTTng and other tracers, check out the LTTng docs. [1]

[0] http://lttng.org/

[1] http://lttng.org/docs/v2.10/#doc-lttng-alternatives