4 ms·
I think that's what BTF and CO-RE are for. They are new; they may not have existed when you had this problem. https://brendangregg.com/blog/2020-11-04/bpf-co-re
by scottlamb 5y ago
I think that's what BTF and CO-RE are for. They are new; they may not have existed when you had this problem. https://brendangregg.com/blog/2020-11-04/bpf-co-re-btf-libbpf.html https://brendangregg.com/blog/2020-11-04/bpf-co-re-btf-libbp...
- brendangregg 5y agoYes, BTF provides the kernel struct info in the vmlinux file. Like debuginfo, but far more lightweight. Of course, tracepoints are better, as they are stable and don't need BTF (although raw_tracepoints do), but there's often cases where they don't exist for the thing I am tracing (and arguably shouldn't exist, if it's too niche/hot-path).
- nyellin 5y agoYeah, I'm familiar with them. Once they're widespread this will be a whole different story. (Here too, if you control the fleet of servers then this is easy. If you're deploying software as a vendor you're stuck with older kernel versions.)