3 ms·

I've been a fan of dtrace for a long time and so I've been meaning to learn BPF to get similar functionality native to the linux kernel. I may pick this book up

• danobi 7y ago
  I suggest taking a look at bpftrace ( https://github.com/iovisor/bpftrace https://github.com/iovisor/bpftrace ). The features and stability are getting quite good and better over time.
  • _wmd 7y ago
    hey! Do you know if anyone is working on getting bpftrace to use BTF yet? Looks like one of the final chunks landed in Linux 5.2
    • leodido 7y ago
      AFAIK not.
    • dustfinger 7y ago
      See Bpftrace for Linux 2018: > https://news.ycombinator.com/item?id=18168137 https://news.ycombinator.com/item?id=18168137 pzakah asks: > You've mentioned that we do have BTF now in Linux 4.18. I've tried to find if it was leveraged in bpftrace, but it looks like it isn't yet. Brendan responds: > That's the old repo (we should add a note to it pointing people to https://github.com/iovisor/bpftrace https://github.com/iovisor/bpftrace instead!) Alastair added struct support for kprobes yesterday, based on the functionality in bcc (which bpftrace uses). That was the final missing piece, and why I'm posting about it now. See the last example here: https://github.com/iovisor/bpftrace/blob/ma https://github.com/iovisor/bpftrace/blob/ma --- .... I took a look and according to the last example mentioned they have not added full struct support yet.
    • mmarchini 7y ago
      Yes, we have an open Pull Request for that: https://github.com/iovisor/bpftrace/pull/734 https://github.com/iovisor/bpftrace/pull/734
  • fntlnz 7y ago
    There’s also a kubernetes version of it: https://github.com/iovisor/kubectl-trace https://github.com/iovisor/kubectl-trace
• otoburb 7y ago
  Brendan Gregg has a post that provides an overview[1] of the various eBPF wrappers that's worth a look if you want to dive further. [1] http://www.brendangregg.com/blog/2019-01-01/learn-ebpf-tracing.html http://www.brendangregg.com/blog/2019-01-01/learn-ebpf-traci...
  • zaphar 7y ago
    Thanks!, That looks quite helpful.