brendangregg

13 ms·

91.
by brendangregg 5y ago
Great news, I'm looking forward to analyzing performance on Windows with BPF! Given that PerfView and WPA also got flame graphs it'll start to feel like home. :-)
92.
by brendangregg 6y ago
Good points; in addition, I can only imagine the headache of trying to support the latest eBPF, io_uring, WireGuard, and other advanced kernel features in WSL1. I imagine a lot of newer features would return ENOSUPP from the kernel, so WSL1
93.
by brendangregg 6y ago
The article did instrumentation such as this: #!/snap/bin/bpftrace #include <net/bluetooth/bluetooth.h> #include <net/bluetooth/hci_core.h> kprobe:mgmt_device_found { $dev=(
94.
by brendangregg 6y ago
For newcomers to BPF tracing, bpftrace is the place to start. It lets you create new tools using several lines of concise code; see the example from this article: https://github.com/devopsspiral/ebpf-bt-unlock/blob
95.
by brendangregg 6y ago
Netflix is lots of Linux and lots of FreeBSD. The Netflix FreeBSD network stack also has various optimizations (we call it the "rack" stack). I've seen a good presentation on how it works, by Randall Stewart, but I don't
96.
by brendangregg 6y ago
Right; there's a better presentation I can't find right now, but here's one from Intel showing how XDP was catching up in 2018 http://vger.kernel.org/lpc_net2018_talks/lpc18_pres_af_xdp_p...
97.
by brendangregg 6y ago
Thanks for getting the BPF book. Further references for BPF bits would be the kernel docs (Documentation/bpf), kernel source (kernel/bpf, include/.../ bpf ), the self tests (tools/testing/selftests/bpf), C
98.
by brendangregg 6y ago
Ah, sorry, that should be GSO (typo!). Generic segmentation offload, which aggregates "super packets" (up to 64 Kbytes) within the network stack to reduce overheads. Pacing controls when to send packets, spreading out transmission
99.
by brendangregg 6y ago
Thanks. I'd expect more future uses of xdp over dpdk. As for max performance (I saw a Linux server max out multiple 10 GbE ports years ago) I'm not sure anyone right now knows what it is. We've recently added XDP, io_uring, B
100.
by brendangregg 6y ago
The Linux network stack has been rapidly evolving; nowadays we have XDP for a fast path through the kernel. But there's also a lot of moving parts that ensure high throughput on noisy networks, for different application workload patter
101.
by brendangregg 6y ago
Yes, io_uring is great, and not just for I/O: it's a generic asynchronous interface for other kernel calls as well.
102.
by brendangregg 6y ago
Please stop using bonnie (I know, it's a 2008 post, but in case it inspires anyone). It was useful at the time, but written in a different era, and nowadays produces misleading results on multi-threaded I/O stacks (along with othe
103.
by brendangregg 6y ago
Thanks for attending my talk and the comment! I hope you've had a chance to run some BPF tools and get some performance wins. :)
104.
by brendangregg 6y ago
The problem is encountering a hiring manager who treats book writing as a red flag: perhaps the candidate is more interested in self promotion and vanity projects than doing real work; perhaps they are too "academic" and don'
105.
by brendangregg 6y ago
Yes, I'd think books can help open the interview door. But then it's about proving you can do the job.
106.
by brendangregg 6y ago
Right; the person saying "I literally wrote the book - hire me" is saying it matters most, and I think that approach is likely to backfire. There are multiple problems with that attitude, including: 1) You probably aren't hir
107.
by brendangregg 6y ago
I'm pretty sure if I showed up to a performance engineering job interview and said "I wrote the book on performance," as though that was what mattered most, I'd be shown the door. In my opinion it would be horrendously a
108.
by brendangregg 6y ago
If it's a common use case it's trivial, and if it's not yet trivial we'll make it trivial. :) Niche functionality that doesn't fit well can be deferred to BCC.
109.
by brendangregg 6y ago
Nice, although if you want to explore networking with ad hoc tracing tools, please try bpftrace[0]. Only use BCC once you need argparse and other python libraries. Here's my bpftrace SYN backlog tool from BPF Performance Tools (2019 bo
110.
by brendangregg 6y ago
Adding network calls to syscalls like exec() is utterly insane. This road can lead to bricked laptops where you can't run anything to fix it (imagine an unexpected network error that the code doesn't handle properly). And crackers
111.
by brendangregg 6y ago
I don't see anyone sharing it, but the video for this talk is here: https://www.infoq.com/presentations/facebook-google-bpf-linu...
112.
by brendangregg 7y ago
I used to be a die-hard advocate of containers, back when they were Solaris Zones. They could destroy the performance of Xen VMs (and I wrote posts explaining the technical reasons why.) But a lot of things changed with HW hypervisors, with
113.
by brendangregg 7y ago
I'm sure someone can answer better than I, but SFO picked CAS before TSA was mandatory.
114.
by brendangregg 7y ago
Neat, but for everyone writing kernel modules: can this be a BPF program? Looking at what LKRG does, it sounds like it can. At my employer, asking us to add a kernel module to our BaseAMI (since this needs to run on every instance) is a ver
115.
by brendangregg 7y ago
That and user stack traces. For many of the kernel tracing tools, I'll add user stack traces as needed for the user context. TCP connections and latency _with_ the Java code paths responsible; ditto for disk I/O, memory growth, lo
116.
BPF Theremin, Tetris, and Typewriters(brendangregg.com)
75 points by brendangregg 7y ago|9 comments
117.
by brendangregg 7y ago
Cilium's container networking and security product [0]; Facebook's Katran [1]; Netflix's flowsrus (not public yet, but see my tcplife tool in BCC[2]). That's just the beginning. It's not just for performance, it&#x2
118.
by brendangregg 7y ago
In particular, those of us using tracers need to understand the frequency of what we instrument, as it relates to overhead. I came up with a frequency table for Chapter 18 of BPF Performance Tools (out soon).
119.
by brendangregg 7y ago
You are free to fork, but that doesn't make it right. Imagine a well-funded startup trying to make a name for themselves decided to fork the top 10 emerging open source projects, put their company name on them, and then spend millions
120.
by brendangregg 7y ago
The author touched on the value of the original author, and this is something missing from the RiiR projects I've encountered. An open source project is more than just code. It's the community: the original authors and maintainers

More ›