Advanced · Module 9 · Lesson 8 of 13
eBPF Performance Diagnostics: Kernel Tracepoints, kretprobes, and bpftrace
Profile live production kernels and applications with eBPF, construct low-overhead tracepoints and kretprobes, aggregate kernel histograms, and run one-liner bpftrace diagnostics.
By the end you can
- Trace kernel execution using static tracepoints and dynamic kprobes with sub-microsecond overhead
- Analyze in-kernel safety verification, JIT compilation, and BPF ring buffer maps
- Capture kernel function latency and return values using kretprobes and hash maps
- Author production diagnostic scripts using bpftrace to inspect I/O latency, scheduler queues, and TCP events
Builds on NUMA Architecture, Memory Interconnects, and CPU Pinning.
01 · A question first
Why does tracing 50,000 IOPS with strace crush disk throughput and stall user processes, while an eBPF script measuring the exact same storage latency runs directly inside the kernel with under 1% overhead?
Make a guess before you read on.
02 · The idea
Members only
Unlock the full lesson
This lesson is part of the membership. Join to read it in full, along with every other premium deep dive.
What's inside
- Start with the problem
- How the idea works
- Production Diagnostics with bpftrace
- Programmatic eBPF in C (libbpf and CO-RE)
- Why it is correct
- What it costs
- Pitfalls and variations
- Where it is used
03 · Practice
Asked in interviews
Something wrong with this lesson? Report a problem