Writing Custom eBPF Programs for O11y: What You Need to Know
summary
Shows an actual C eBPF program that compiles to bytecode, passes the verifier (no loops), and creates a BPF map for packet counters and events; demonstrates a native packet-logging probe and a BCC Python variant that attaches at runtime. Tests run on an AWS free tier micro and include a 100 requests load test against nginx. Code exports metrics to user space, compiles and loads, and the demos produce observable kernel-level counters that are readable and reusable.
AI-written summary · about
chapters (11)
- 0:00Introduction to Custom eBPF Programs
- 0:12Understanding eBPF Technology
- 1:16eBPF Program Architecture
- 2:23Advantages of eBPF for Observability
- 3:52Real-World Use Cases and Examples
- 4:28Demo: Setting Up eBPF Environment
- 5:00Demo: Packet Logging with eBPF
- 8:01Demo: Python eBPF Program with BCC
- 11:08Extending eBPF Capabilities
- 12:00eBPF Ecosystem and Tools
- 13:33Conclusion and Further Learning
related talks
01h 18mTutorial: Getting Started with eBPF
32mExploring the Power of eBPF for System Observability
29meBPF on the Rise - Getting Started
16mWhy Everyone Should Care About eBPF
31meBPF 101
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
43meBPF Superpowers for SRE
39meBPF Superpowers for Go programmers