Re:Unlocking eBPF power
by brendangregg on Thursday October 08, 2020 @04:11PM
(#24723352)
For newcomers to BPF tracing, bpftrace is the place to start. It lets you create new tools using several lines of concise code; see the example from this article:
As BTF (BPF Type Format) becomes the default in kernels, this short tool will become even shorter: the "( struct hci_dev *) arg0" cast won't be necessary as the kernel will already know what type arg0 is. So line 9 can be skipped.
I see a lot of people start with other BPF tracers that made sense years ago as we hadn't built bpftrace yet. It'll really save you a lot of time to look at bpftrace first and then others only if need be. bpftrace is installed by default on all cloud instances at Netflix and other companies: it's the go-to tool for whipping up custom tracing programs.
https://github.com/devopsspiral/ebpf-bt-unlock/blob/master/b...
As BTF (BPF Type Format) becomes the default in kernels, this short tool will become even shorter: the "( struct hci_dev *) arg0" cast won't be necessary as the kernel will already know what type arg0 is. So line 9 can be skipped.
I see a lot of people start with other BPF tracers that made sense years ago as we hadn't built bpftrace yet. It'll really save you a lot of time to look at bpftrace first and then others only if need be. bpftrace is installed by default on all cloud instances at Netflix and other companies: it's the go-to tool for whipping up custom tracing programs.