3 ms·

How would you recommend learning about eBPF / BTF / CO-RE? I have a basic understanding of what they are, but am not sure where to start for writing eBPF tracin

How would you recommend learning about eBPF / BTF / CO-RE? I have a basic understanding of what they are, but am not sure where to start for writing eBPF tracing programs, setting them up in production w/ Grafana, etc.

tanelpoder 2y ago
For getting started with eBPF performance mindset, I normally recommend Brendan Gregg's book just to see what's possible: - https://www.brendangregg.com/bpf-performance-tools-book.html https://www.brendangregg.com/bpf-performance-tools-book.html And as a related activity, you could just install the bcc-tools package (on RHEL clones) and check out the /usr/share/bcc/tools directory to see what's already implemented (on latest Ubuntu, these tools seem to be installed in /usr/sbin, etc, but you could "find /usr -name *bpfcc" to get a list of eBPF tools already installed there (and test/man some more interesting ones). For the bigger picture and other eBPF uses like networking, I'd get Liz Rice's eBPF book (free download): - https://isovalent.com/books/learning-ebpf/ https://isovalent.com/books/learning-ebpf/ But the most valuable resource for me when I took the leap from writing bpftrace one-liners to more sophisticated modern eBPF programs was (and still is) Andrii Nakryiko's blog with examples of modern BPF programming: - https://nakryiko.com/ https://nakryiko.com/
- AceJohnny2 2y ago
  > but you could "find /usr -name bpfcc"* Or ask your package manager. Debian (Ubuntu): `dpkg -L bpfcc-tools`, RedHat: `rpm -ql bcc-tools`