Ask HN: Why is eBPF a popular approach to monitoring?

6 pointsjmartens2 comments

For the developer that needs observability, why would they want an approach to monitoring that utilized eBPF instead of a language agent?

View on HN

eBPF tracing programs are executed at tracepoints, kprobes, or uprobes, so they are entirely language agnostic, have access to the data structures only available to the kernel, persist across processes/threads, are nearly guaranteed not to crash the system (by the verifier), and write to data structures that appear in well-known locations in the sysfs filesystem.

BSD and Solaris variants have had this type of thing for years with DTrace, which is “the way” to do observability on those systems. Now Linux has an even better way.

I highly encourage you to try out any of the tools scripts in the BCC repo. They’re just Python scripts that do really cool things that have never been done before! BPF is not that hard to get started with!

https://github.com/iovisor/bcc/tree/master/tools

For one thing eBPF is multi-language and it can see into the kernel.

Reply on news.ycombinator.com