Linux Observability with BPF

Re:Linux Observability with BPF by zaphar on Thursday July 11, 2019 @12:34PM (#20412954)

I've been a fan of dtrace for a long time and so I've been meaning to learn BPF to get similar functionality native to the linux kernel. I may pick this book up.

[ Parent | on HN ]

Re:Linux Observability with BPF by otoburb on Thursday July 11, 2019 @01:27PM (#20413496)

Brendan Gregg has a post that provides an overview[1] of the various eBPF wrappers that's worth a look if you want to dive further.

[1] http://www.brendangregg.com/blog/2019-01-01/learn-ebpf-traci...

[ Parent | on HN ]

Re:Linux Observability with BPF by zaphar on Thursday July 11, 2019 @03:38PM (#20414932)

Thanks!, That looks quite helpful.

[ Parent | on HN ]

Re:Linux Observability with BPF by danobi on Thursday July 11, 2019 @01:12PM (#20413330)

I suggest taking a look at bpftrace ( https://github.com/iovisor/bpftrace ). The features and stability are getting quite good and better over time.

[ Parent | on HN ]

Re:Linux Observability with BPF by fntlnz on Thursday July 11, 2019 @01:41PM (#20413610)

There’s also a kubernetes version of it:

https://github.com/iovisor/kubectl-trace

[ Parent | on HN ]

Re:Linux Observability with BPF by _wmd on Thursday July 11, 2019 @01:25PM (#20413467)

hey! Do you know if anyone is working on getting bpftrace to use BTF yet? Looks like one of the final chunks landed in Linux 5.2

[ Parent | on HN ]

Re:Linux Observability with BPF by dustfinger on Thursday July 11, 2019 @02:57PM (#20414361)

See Bpftrace for Linux 2018:

> https://news.ycombinator.com/item?id=18168137

pzakah asks:

> You've mentioned that we do have BTF now in Linux 4.18. I've tried to find if it was leveraged in bpftrace, but it looks like it isn't yet.

Brendan responds:

> That's the old repo (we should add a note to it pointing people to https://github.com/iovisor/bpftrace instead!)

Alastair added struct support for kprobes yesterday, based on the functionality in bcc (which bpftrace uses). That was the final missing piece, and why I'm posting about it now. See the last example here:

https://github.com/iovisor/bpftrace/blob/ma

--- ....

I took a look and according to the last example mentioned they have not added full struct support yet.

[ Parent | on HN ]

Re:Linux Observability with BPF by mmarchini on Thursday July 11, 2019 @03:03PM (#20414435)

Yes, we have an open Pull Request for that: https://github.com/iovisor/bpftrace/pull/734

[ Parent | on HN ]

Re:Linux Observability with BPF by leodido on Thursday July 11, 2019 @02:02PM (#20413817)

AFAIK not.

[ Parent | on HN ]