Get deeper insights into your system with eBPF

Keen Observer

© Lead Image © Ioannis Kounadeas, Fotolia.com

© Lead Image © Ioannis Kounadeas, Fotolia.com

Article from Issue 225/2019
Author(s):

Use the eBPF in-kernel virtual machine to identify resource bottlenecks and optimize your installation.

eBPF [1] is a relatively new addition to the Linux kernel that takes over more monitoring, security, and networking duties from individual kernel modules. Originally called the Berkeley Packet Filter, BPF came to life in 1992 [2] in order to provide a better and optimized mechanism to filter packets.

BPF was first used as an HTTP packet filter in BSD. Several decades later, it was completely rehashed and took on new tasks. The new version of BPF is what is known as enhanced BPF or eBPF. In addition to various new features, eBPF also has a new mechanism to connect to the Linux kernel. Instead of just redirecting packets, eBPF can attach itself to any kernel event or any socket. eBPF is tightly integrated with the Linux kernel and can be used as an efficient mechanism for Linux tracing. You can also use eBPF behind the scenes on your Linux machines to discover performance issues and bottlenecks.

Get Started

eBPF requires a kernel newer than v4.4 and one that has been compiled with the CONFIG_BPF_SYSCALL option. Neither of these requirements should be a problem if you are using one of the mainstream distributions like Ubuntu and updating it regularly.

[...]

Use Express-Checkout link below to read the full article (PDF).

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
 
SUBSCRIPTIONS
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • perf

    The kernel supports performance analysis with built-in tools via the Linux performance counters subsystem. perf is easy to use and offers a detailed view of performance data.

  • Charly's Column

    Some people don’t mind leaving traces of their IP address wherever they go, others prefer to use a tool like The Onion Router.

  • Core Technologies

    Everyone wants to be root, because root can do anything. But in fact, its powers are now split. Learn more in this overview of capability sets.

  • Tracing Tools

    Programs rarely reveal what they are doing in the background, but a few clever tools, of interest to both programmers and administrators, monitor this activity and log system functions.

  • Charly's Column: My Traceroute

    Charly takes the name of the “My Traceroute” tool very literally. The journey is the reward for this alternative TTL-measuring utility.

comments powered by Disqus

Direct Download

Read full article as PDF:

Price $2.95

News