Velocity 2017: Performance Analysis Superpowers with Linux eBPF

Talk for Velocity 2017 by Brendan Gregg. Abstract: "Advanced performance observability and debugging have arrived built into the Linux 4.x series, thanks to enhancements to Berkeley Packet Filter (BPF, or eBPF) and the repurposing of its sandboxed virtual machine to provide programmatic capabilities to system tracing. Netflix has been investigating its use for new observability tools, monitoring, security uses, and more. This talk will investigate this new technology, which sooner or later will be available to everyone who uses Linux. The talk will dive deep on these new tracing, observability, and debugging capabilities. Whether you’re doing analysis over an ssh session, or via a monitoring GUI, BPF can be used to provide an efficient, custom, and deep level of detail into system and application performance.
This talk will also demonstrate the new open source tools that have been developed, which make use of kernel- and user-level dynamic tracing (kprobes and uprobes), and kernel- and user-level static tracing (tracepoints). These tools provide new insights for file system and storage performance, CPU scheduler performance, TCP performance, and a whole lot more. This is a major turning point for Linux systems engineering, as custom advanced performance instrumentation can be used safely in production environments, powering a new generation of tools and visualizations."

[@domaincontroller]

05:03 tcplife, tcpdump 08:19 linux 4.4+ 19:40 linux perf analysis in 60s

[@deltagamma1442]

I want to be this guy. Not even kidding.

[@darnellcaballes]

agreed. guy is sharp, and takes complicated subject and breaks it down for the layperson... mark of a master...

[@elidrissii]

Why would you be kidding? His books are so good, that's how I found out about him.

[@acidixzkinght9575]

Best lecture I have ever seen

[@brewtaldeafmedal1262]

next level hand movement

[@tomknud]

Is that a bee or a dragon fly? Isn't that CSRA in SHV?

[@supertren]

"My name is Brendan"....he is also modest.

[@xealit]

13:35 "so, with BPF it will attach a program on an event and that event might be a tracepoint, kprobes etc" -- which type of event a kernel function is (in the function counting at the beginning of presentation)? Tracepoints don't cover all function calls, right? Then, do you attach a kprobe on function call?

[@epolpier]

That's exactly what kprobe is for

[@tezcanaslan2877]

I hope you are continuing to scream at hard drives

[@Ablyss]

May I have your UA-cam account please I will put it to good use I’m 13 and I’m trying to make a name for myself it would mean the world 🥺🥺

[@ProfessionalBabyEater]

you should try screaming at babies next