4 ms·
They're really very different -- with very different origins and constraints. If you want to hear about my own experiences with bpftrace, I got into this a bit
by bcantrill 3y ago
They're really very different -- with very different origins and constraints. If you want to hear about my own experiences with bpftrace, I got into this a bit recently.[0] (And in fact, one of my questions about the article is how they deal with silently dropped data in eBPF -- which I found to be pretty maddening.)
[0] https://www.youtube.com/watch?v=mqvVmYhclAg#t=12m0s https://www.youtube.com/watch?v=mqvVmYhclAg#t=12m0s
- edenfed 3y agoBy dropped data do you mean by exceeding the size of the allocated ring buffer/perf buffer? If so this is configurable by the user, so you can adjust is according to the expected load
- bcantrill 3y agoeBPF can drop data silently under quite a few conditions, unfortunately. And -- most frustratingly -- it's silent, so it's not even entirely clear which condition you've fallen into. This alone is a pretty significant with respect to DTrace: when/where DTrace drops data, there is always an indicator as to why. And to be clear, this isn't a difference merely of implementation (though that too, certainly), but of principle: DTrace, at root, is a debugger -- and it strives to be as transparent to the user as possible as to the truth of the underlying system.
- zengid 3y agoI listened to this live! That's probably why I was wondering, because I remember you talking about something you used in Linux that didn't quite live up to your expectations with DTrace, but I didn't catch all of the names. Thanks!