DWARFs and ELFs on the Cloud - eBPF Profiling Adventures in Observability at...
summary
Continuous, high-resolution profiling using eBPF to grab stack addresses from running processes and DWARF and ELF debug sections; an on-host agent discovers targets via /proc, samples registers via a perf-event hook (~19Hz), compresses addresses and sends them to a server that links addresses to functions by build ID and debug-info symbolication. Prototype Parca agent + server runs system-wide with zero instrumentation, supports multiple architectures and JITed runtimes, and is deployed at Polar Signals but seeks feedback to improve scale and coverage.
AI-written summary · about
chapters (15)
- 0:00Profiling and incident challenges
- 2:32Introduction
- 3:14What is profiling
- 5:21Continuous profiling
- 6:04High-resolution dynamic profiling needs
- 7:09Parka server visualization demo
- 8:15Parka stack trace analysis
- 9:41Parka labels and queries
- 11:30Target discovery for profiling
- 13:39ELF and DWARF formats
- 15:22Binary sections and debug info
- 17:53Using readelf to parse binary
- 18:58eBPF stack trace building
- 20:05Symbolizing memory addresses
- 20:49Closing remarks
related talks
36mDeveloping Continuous eBPF Profiler to look Beneath the Kernel to Beyond the Clouds
36mContinuous Profiling with Parca- Beneath the Kernel to Beyond...
36mProfiling in the cloud-native era - Matthias Loibl
38mAdvanced BPF profiling techniques: how to escape the curse of NMI and fetch ELF...
26mProfiling Mastery: Decode Your Data and Elevate Observability
37meBPF: Revolutionizing Observability and Telemetry for Modern Applications
20mThink eBPF for Kernel Security Monitoring
24mDebuggers and eBPF: Bringing Debugging to Production