3 ms·
This works great if you control the servers or have a uniform fleet. I used to work at a security vendor which sold ebpf based software that ran as a daemonset
by nyellin 5y ago
This works great if you control the servers or have a uniform fleet. I used to work at a security vendor which sold ebpf based software that ran as a daemonset on customer kubernetes clusters. Compiling ebpf bytecode on the customer's hosts wasn't an option.
Iirc the real challenge was with writing kprobe ebpf functions that access native structs. I don't think we ever found a good solution for that because you need kernel headers for each machine which we didn't have.
Of course if I'm missing something obvious, do tell!
(I'm the same person who left this comment on Brendan's site as well. Not a random copy paster)
- scottlamb 5y agoI think that's what BTF and CO-RE are for. They are new; they may not have existed when you had this problem. https://brendangregg.com/blog/2020-11-04/bpf-co-re-btf-libbpf.html https://brendangregg.com/blog/2020-11-04/bpf-co-re-btf-libbp...
- brendangregg 5y agoYes, BTF provides the kernel struct info in the vmlinux file. Like debuginfo, but far more lightweight. Of course, tracepoints are better, as they are stable and don't need BTF (although raw_tracepoints do), but there's often cases where they don't exist for the thing I am tracing (and arguably shouldn't exist, if it's too niche/hot-path).
- nyellin 5y agoYeah, I'm familiar with them. Once they're widespread this will be a whole different story. (Here too, if you control the fleet of servers then this is easy. If you're deploying software as a vendor you're stuck with older kernel versions.)
- fazzone 5y agoThe Linux kernel can be configured at build time to expose its own headers as /proc/kheaders.tar.xz. Not sure if distribution kernels generally have this option enabled or not.