Zero-instrumentation observability based on eBPF
summary
Claims that eBPF collects metrics, logs and traces for containers and hosts with low overhead, no app code changes, and minute-scale deployment via a per-node agent. Uses kprobes/tracepoints, uprobe maps and kernel validation to map TCP connections to processes, capture filesystem and network events, and do continuous CPU profiling. Produces synthetic traces but cannot assign canonical span IDs across services and requires elevated node privileges, and is packaged as an open source agent called karut.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:47Observability matters
- 3:28Application complexity
- 4:33Four pillars of observability
- 9:37Traditional instrumentation challenges
- 13:50Telemetry without app changes
- 15:19What is eBPF
- 17:54eBPF concepts and kernel
- 21:29Karut observability solution
- 24:45eBPF overhead and benefits
- 27:16Simulating distributed traces
- 28:44CPU profiling with eBPF
- 29:06Why eBPF is a game-changer
related talks
31mZero instrumentation observability with eBPF
37meBPF: Revolutionizing Observability and Telemetry for Modern Applications
31meBPF for Observability: The Good, the Bad, and the Ugly
31mTrue Kubernetes Observability with eBPF
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
27mStep By Step Kubernetes Observability with eBPF
31mBridging Dev and Ops with eBPF: Extending Observability Upwards and Downwards
30mObservability in Kubernetes: Unlocking the Power of eBPF