eBPF: Fueling New Flame Graphs & more
summary
eBPF becomes a kernel-hosted VM that runs verified JIT-compiled programs to do tracing, security and networking with real deployments like 14 BPF programs at Netflix and 40 at Facebook; tools used include perf, Brendan Gregg’s flamegraph.pl pipeline, BCC and bpftrace, and a D3 visualizer. Practical builds include low-overhead kernel-side aggregation for flame graphs, continuous profiling prototypes, and off-CPU flame graphs that reveal blocking chains — many features work now, some (off-CPU merging, distro frame-pointer fixes) remain work in progress.
AI-written summary · about
chapters (17)
- 0:00Introduction to eBPF
- 1:50Understanding flame graphs
- 7:05Origin of flame graphs
- 12:07Flame graphs vs charts
- 15:08Interpreting flame graphs
- 19:12Creating and using tools
- 22:49What is eBPF
- 28:42The eBPF revolution
- 33:26eBPF technical details
- 37:07Safety and security
- 39:39eBPF observability tools
- 45:03Practical approach to eBPF
- 48:21eBPF and future outlook
- 50:39eBPF flame graphs
- 55:01Key takeaways and conclusion
- 57:31Q&A session
- 1:00:30Q&A session continued
related talks
29meBPF on the Rise - Getting Started
33meBPF: exploring use case of BPF kernel infrastructure
32meBPF: The Next Power Tool of SREs
16mWhy Everyone Should Care About eBPF
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
42mCommunity Driven Breakout Session: eBPF and Auto-Instrumentation
36mObservability and performance analysis with BPF
31meBPF 101