Open Source Summit North America 2023

In software engineering, tracing is a method to collect data for profiling and debugging. The objective is to provide useful information at runtime for future analysis. The main advantage of using eBPF for tracing is that you can access almost any piece of information from the Linux kernel and your applications. BPF adds a minimum amount of overhead to the system’s performance and latency in comparison with other tracing technologies, and it doesn’t require developers to modify their applications for the only purpose of gathering data from them. The Linux kernel provides several instrumentation capabilities that can be used in conjunction with BPF. In this presentation we talk about these different capabilities and show how the kernel exposes those capabilities in your operating system so that you know how to find the information available to your BPF programs. We are going to talk how tracing can provide you with a deep understanding of any system using eBPF.