Falco & eBPF: Is the only Limit the Sky?
Talkat Cloud Native eBPF Day Europe 2022 · on Monday, 2022-05-16· at 13:30· Pavilion 4 | Room A | Level 2 | Central Forum·
summary
Falco uses eBPF to trace syscalls, page faults and context switches and claims to handle up to billions of events per second, but user space drops most data: a stress test shows 34 million produced vs 4 million captured. Current mitigations include a simple consumer mode that cuts drop rate from ~90% to ~60% by filtering syscalls, and plans target moving filters early using BTF/global variables and per-syscall attach points or libbpf relocatable bytecode to fix the big portability and instrumentation overheads.
AI-written summary · about
chapters (8)
- 0:00Intro
- 1:06Falco: a peculiar eBPF use case
- 3:13How instrumentation works?
- 7:30Consumer issue
- 9:35Current mitigations
- 12:02Instrumentation issue
- 16:04Future enhancements
- 18:24The portability issue
related talks
20mThink eBPF for Kernel Security Monitoring
16mWhy Everyone Should Care About eBPF
43meBPF Superpowers for SRE
32mReal Time Security - eBPF for Preventing attacks
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
32mExploring the Power of eBPF for System Observability
32meBPF: The Next Power Tool of SREs
20mClosing Perspectives