Thank you for your work on tcpdump, (original) bpf and the pcap library. I benefit from those projects everyday.
ZSON looks way better than JSON. I pray that the Zed project becomes more popular.
ZSON looks way better than JSON. I pray that the Zed project becomes more popular.
Coincidentally, after hearing of a friend's woes dealing with massive amounts of CSV coming from a BPF-instrumental kernel, I played around a bit with integrating Zed and BPF. Just an experimental toy (and the repo is already out of date)...
https://github.com/brimdata/zbpf
The nice thing about Zed here is any value can be a group-by key so it's easy, for example, to use kernel stacks (an array of strings) in a grouping aggregate.
(p.s. for the record, the only thing I have to do with the modern linux BPF system is the tiny vestige of origin story it shares with the original work I did in the BSD kernel around 1990)