How to add eBPF observability to your product
brendangregg.com
How to add eBPF observability to your product
1–10 of 32 posts
Re: How to add eBPF observability to your product
#2According to Wikipedia, BPF stands for [Berkeley Packet Filter][1] and can be used to observe packets sent by a process.
Re: How to add eBPF observability to your product
#3According to Wikipedia, BPF stands for [Berkeley Packet Filter][1] and can be used to observe packets sent by a process. [1]: https://en.m.wikipedia.org/wiki/Berkeley_Packet_Filter
Technically, yes, but in practice not really; eBPF started as an extension of the packet filtering framework and then got generalized to be a nearly-universal debugging/monitoring/tracing system that's only sometimes used for packets. https://ebpf.io/ is a decent starting point for reading.
Re: How to add eBPF observability to your product
#4According to Wikipedia, BPF stands for [Berkeley Packet Filter][1] and can be used to observe packets sent by a process. [1]: https://en.m.wikipedia.org/wiki/Berkeley_Packet_Filter
Technically, yes, but in practice not really; eBPF started as an extension of the packet filtering framework and then got generalized to be a nearly-universal debugging/monitoring/tracing system that's only sometimes used for packets. https://ebpf.io/ is a decent starting point for reading.
Thanks for explaining that - I was totally missing the point to be honest.
Re: How to add eBPF observability to your product
#5According to Wikipedia, BPF stands for [Berkeley Packet Filter][1] and can be used to observe packets sent by a process. [1]: https://en.m.wikipedia.org/wiki/Berkeley_Packet_Filter
And eBPF stands for extended Berkeley Packet Filter:
> eBPF is an extended BPF JIT virtual machine in the Linux kernel
It's really quite an amazing tool, especially since you can use it to run sandboxed programs in kernel without changing kernel source or loading a kernel module. These programs can be written using a limited dialect of C.
Some examples of its use can be found here: https://github.com/iovisor/bcc/tree/master/examples
Re: How to add eBPF observability to your product
#6Earlier quoted context omitted.
Technically, yes, but in practice not really; eBPF started as an extension of the packet filtering framework and then got generalized to be a nearly-universal debugging/monitoring/tracing system that's only sometimes used for packets. https://ebpf.io/ is a decent starting point for reading.
Thanks for explaining that - I was totally missing the point to be honest.
Yeah, the name is kinda unfortunate in the modern context, but in fairness it's easy to not expect that a packet filtering framework will turn out to be the basis for a universal kernel tracing system...
Re: How to add eBPF observability to your product
#7According to Wikipedia, BPF stands for [Berkeley Packet Filter][1] and can be used to observe packets sent by a process. [1]: https://en.m.wikipedia.org/wiki/Berkeley_Packet_Filter
eBPF is more capable of BPF. It's a general hooking mechanism in the Linux kernel. Think Aspect-Oriented Programming, but in the kernel. The biggest benefit I think is that it can intercept and modify function calls in many places, not just the kernel. Intercepting/filtering bad data at the network driver level is much more efficient than letting the data reaching the kernel code.
Re: How to add eBPF observability to your product
#8According to Wikipedia, BPF stands for [Berkeley Packet Filter][1] and can be used to observe packets sent by a process. [1]: https://en.m.wikipedia.org/wiki/Berkeley_Packet_Filter
Technically, yes, but in practice not really; eBPF started as an extension of the packet filtering framework and then got generalized to be a nearly-universal debugging/monitoring/tracing system that's only sometimes used for packets. https://ebpf.io/ is a decent starting point for reading.
My biggest pet peeve is when authors don't just start with a 1-2 sentence outline of the topic that they're discussing, and instead go directly into acronym soup. And I've been in software development for a long time and have never heard of BPF/eBPF before.
Thank you for your explanation.
Re: How to add eBPF observability to your product
#9Earlier quoted context omitted.
Technically, yes, but in practice not really; eBPF started as an extension of the packet filtering framework and then got generalized to be a nearly-universal debugging/monitoring/tracing system that's only sometimes used for packets. https://ebpf.io/ is a decent starting point for reading.
My biggest pet peeve is when authors don't just start with a 1-2 sentence outline of the topic that they're discussing, and instead go directly into acronym soup. And I've been in software development for a long time and have never heard of BPF/eBPF before. Thank you for your explanation.
Brendan Gregg is the author of eBPF, and he writes on his blog. It is fair to assume a basic knowledge of his works when reading his website.
Re: How to add eBPF observability to your product
#10Earlier quoted context omitted.
Technically, yes, but in practice not really; eBPF started as an extension of the packet filtering framework and then got generalized to be a nearly-universal debugging/monitoring/tracing system that's only sometimes used for packets. https://ebpf.io/ is a decent starting point for reading.
My biggest pet peeve is when authors don't just start with a 1-2 sentence outline of the topic that they're discussing, and instead go directly into acronym soup. And I've been in software development for a long time and have never heard of BPF/eBPF before. Thank you for your explanation.
Brendan Gregg literally wrote the book on this kind of stuff, if you search for any of this tracing stuff it comes up with his website anyway.