eBPF for Observability: The Good, the Bad, and the Ugly
Talkat Observability Day Europe 2023 · on Tuesday, 2023-04-18· at 16:50· Hall 7, Room E | Ground Floor | Europe Complex·
summary
eBPF makes the Linux kernel programmable so observability runs without app code changes and with low overhead. Examples show kprobes and uprobes attached to events, BPF maps as the in-kernel key value store, and perf sampling used for continuous CPU profiles (Parca/Pixie style). Cilium/Hubble provides packet‑level visibility and Tetragon gives file and syscall tracing. OpenTelemetry Go auto‑instrumentation writes trace headers into maps but is very early. Major limits are lack of business context and exploding data volumes that require heavy filtering.
AI-written summary · about
chapters (5)
- 0:00Start
- 4:07Attachment points
- 20:39Security observability
- 26:36Distributed tracing
- 29:02Observability with eBPF is challenging
related talks
37meBPF: Revolutionizing Observability and Telemetry for Modern Applications
38meBPF for Observability: Hard Truths and Practical Wins
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
30mObservability in Kubernetes: Unlocking the Power of eBPF
31mBridging Dev and Ops with eBPF: Extending Observability Upwards and Downwards
36mFrom Monitoring to Observability: eBPF Chaos - Michael Friedrich
32mExploring the Power of eBPF for System Observability
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services