Live data from Hacker News

BPF Performance Tools: Linux System and Application Observability

brendangregg.com

21–30 of 39 posts

Re: BPF Performance Tools: Linux System and Application Observability

#21

are all the scripts/tools Brendan is talking about going to be open source? (I'm sure some of them are, including the ones on his Github)

Yes. I've been working on a github repo that contains all the tools. It's not online yet.

Brendan, thanks for writing the book. Will definitely get this. As someone looking to always expand my skillset, do you think there will be a lot of demand for programmers who know BPF in the future/now? I'm always interested in low-level OS/internals. Current job is in HW design.

Re: BPF Performance Tools: Linux System and Application Observability

#22

Earlier quoted context omitted.

Yes. I've been working on a github repo that contains all the tools. It's not online yet.

Brendan, thanks for writing the book. Will definitely get this. As someone looking to always expand my skillset, do you think there will be a lot of demand for programmers who know BPF in the future/now? I'm always interested in low-level OS/internals. Current job is in HW design.

Yes, but what exactly varies on the role. Eg:

- Developers and system engineers: will add the BCC and bpftrace tools to their toolkit for analyzing issues, but they won't necessarily need to develop new ones themselves (so long as someone at the company can, as needed). The book targets this (large) audience by covering over 150 tools.

- Some developers will use the BPF tracers like bpftrace as a primary debugging tool as it's the best available for their language (eg, user and kernel C and C++); other mature runtimes may already have a tracer that developers are already using, making bpftrace a secondary debugging tool for digging deeper. In that case, you may find there is one or two people on a development team who learn bpftrace and deal with the deeper debugging, whereas others get by with their primary tracer. The book targets these audiences too, by explaining bpftrace programming and including many examples.

- There's another smaller audience where there'll be BPF demand that is not the focus of the book: custom BPF products. In the past, a monitoring/security company might sell you a loadable kernel module to do their thing; in the future, those should all become BPF programs (where possible), which are safer to run. There will also be new applications made possible by BPF. Some of these products will be bpftrace/BCC-based, and the book will be helpful. So I'd expect to see some demand for these BPF skills too, although it's a much narrower audience than the others. It'll be companies trying to hire BPF programmers to migrate their kernel modules to. Some companies already sell such BPF things (Cilium, Sysdig).

Re: BPF Performance Tools: Linux System and Application Observability

#23
It's great that BPF can be used to implement all kinds of monitoring tools for Linux. But I would really like it if pcap-filter finished implementing basic BPF primitives for IPv6 that have worked in IPv4 since the beginning.

From the pcap-filter(7) manpage: "Note that tcp, udp and other upper-layer protocol types only apply to IPv4, not IPv6 (this will be fixed in the future). "

Sometimes reading posts about BPF makes me think I'm the only one still using it to filter packets.

Re: BPF Performance Tools: Linux System and Application Observability

#25
post #4

Earlier quoted context omitted.

If you have a Safari subscription, you can read the rough edit now! Pro-tip: You can get free access to Safari by becoming a member of the ACM.

It is not on Safari right now, but should be soon. Good tip!

Would love to see it on Safari books.

Re: BPF Performance Tools: Linux System and Application Observability

#27

shut up and take my money already !

Who ever has been downvoting this isn't getting the Futurama reference[1]. That was about the "eye"-phone. For the uninitiated, it means that they want the product faster.

Seriously, its a (humorous) vote of confidence in Brendan's work.

[1] https://knowyourmeme.com/memes/shut-up-and-take-my-money

Re: BPF Performance Tools: Linux System and Application Observability

#28

It's great that BPF can be used to implement all kinds of monitoring tools for Linux. But I would really like it if pcap-filter finished implementing basic BPF primitives for IPv6 that have worked in IPv4 since the beginning. From the pcap-filter(7) manpage: "Note that tcp, udp and other upper-layer protocol types only apply to IPv4, not IPv6 (this will be fixed in the future). " Sometimes reading posts about BPF mak…

There are still people working on packet filtering! The BPF enhancements are benefiting lots of different areas of the Linux world at the same time.

Cilium [1] is a great example of how the new capabilities of BPF can be used for more complex packet filtering, such as understanding higher level protocols.

[1] https://cilium.io/

Re: BPF Performance Tools: Linux System and Application Observability

#30
post #4

Can’t wait to get a copy!

If you have a Safari subscription, you can read the rough edit now! Pro-tip: You can get free access to Safari by becoming a member of the ACM.

Also if you are residing in any "developing countries" (India, Brazil, Romania, etc.) ACM offers their membership at a special discounted rate.
Post reply on HN