Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Relic to open-source Pixie’s eBPF observability platform

blog.pixielabs.ai

Post reply on HN
Print view View original

21–30 of 66 posts

Re: New Relic to open-source Pixie’s eBPF observability platform

#21

Post by justicezyx »

throwaway894345 wrote: post #5
thejonanshow wrote: post #3

I'm curious to hear people's thoughts on eBPF generally, it seems likely that this is where observability companies are headed. It's non-trivial to implement but monitoring from the kernel layer makes so much sense that I expect the tooling will come along quickly.

What's the advantage of monitoring from the kernel layer? It's not jumping out at me...

A few things:

* Non intrusive: meaning one can snoop info of application without changing application code.

* Deep visibility: function level and syscall/kernel functions reveal more context and are more accurate in a lot of cases.

* Low overhead: everything runs inside kernel space, no context switching compared to other kernel based/aided tracing.

* Expressiveness: eBPF is fairly expressive, can do many things that usually are exclusive to high level programming languages.

Re: New Relic to open-source Pixie’s eBPF observability platform

#22

Post by suthakamal »

SEJeff wrote: post #11
throwaway894345 wrote: post #5

Earlier quoted context omitted.

What's the advantage of monitoring from the kernel layer? It's not jumping out at me...

Tracing from user to kernel back to userspace in one single pane of glass. Have you never heard anyone hype about DTrace on Solaris? This allows building similar things on production systems with little to no impact on running production applications.

hadn't thought of this like DTrace. Thx for that!

Re: New Relic to open-source Pixie’s eBPF observability platform

#23

Post by imukherjee »

pkaye wrote: post #15
imukherjee wrote: post #9

Earlier quoted context omitted.

Co-Founder/CPO of Pixie here. This definitely is an unprecedented and forward looking investment by New Relic. While ambitious, it became evident in our conversations with them they we committed on standardizing on open source telemetry standards such as Prometheus, Open-Telemetry, Graphana etc. We're not yet in a position to speak for them in detail but we believe this bet on our project reinforces their plan to ope…

How does Pixie technology compare to Sysdig? Do they do similar things?

The underlying data collection approach is similar however, our focus in application performance monitoring for developers and Sysdig's focus is on container level security & monitoring for devops,devsecops (@Sysdig folks please correct me if I am wrong :) )

Sysdig was a pioneer in harvesting data from the kernel. Their original solution required installing a kernel module and they are now moving to eBPF based approaches. The Falco project is really exciting.

Since we're a relatively new project (started 2 years ago) we started with eBPF and built our platform around it. As we open source we'll share with groups like Falco and hopefully collaborate.

Re: New Relic to open-source Pixie’s eBPF observability platform

#25

Post by [deleted] »

justicezyx wrote: post #21
throwaway894345 wrote: post #5

Earlier quoted context omitted.

What's the advantage of monitoring from the kernel layer? It's not jumping out at me...

A few things: * Non intrusive: meaning one can snoop info of application without changing application code. * Deep visibility: function level and syscall/kernel functions reveal more context and are more accurate in a lot of cases. * Low overhead: everything runs inside kernel space, no context switching compared to other kernel based/aided tracing. * Expressiveness: eBPF is fairly expressive, can do many things that…

[deleted]

Re: New Relic to open-source Pixie’s eBPF observability platform

#26

Post by xiphias2 »

dan-buzzkill wrote: post #4
thejonanshow wrote: post #3

I'm curious to hear people's thoughts on eBPF generally, it seems likely that this is where observability companies are headed. It's non-trivial to implement but monitoring from the kernel layer makes so much sense that I expect the tooling will come along quickly.

eBPF is great but it only works for linux and access to the kernel layer doesn't work for serverless environments, so it's definitely a piece of the puzzle but not a silver bullet IMO.

Is there any technical reason why it couldn't work with serverless?

Re: New Relic to open-source Pixie’s eBPF observability platform

#30

Post by daxfohl »

neelaj wrote: post #20

My take is that eBPF is such a powerful technology that it holds the potential to fundamentally change how Networking, Observability and Security are delivered. Just like Virtualization and now Containers/Kubernetes challenged an entire industry focused on big servers, the ability to safely embed programs into the Linux Kernel w/ eBPF challenges every incumbent. We're seeing every incumbent vendor look hard at the te…

I wonder if there's anything in the pipeline for storage.
Post reply on HN