BPF Performance Tools

Use BPF Tools to Optimize Performance, Fix Problems, and See Inside Running Systems

BPF-based performance tools give you unprecedented visibility into systems and applications, so you can optimize performance, troubleshoot code, strengthen security, and reduce costs. BPF Performance Tools: Linux System and Application Observability is the definitive guide to using these tools for observability.

Pioneering BPF expert Brendan Gregg presents more than 150 ready-to-run analysis and debugging tools, expert guidance on applying them, and step-by-step tutorials on developing your own. You’ll learn how to analyze CPUs, memory, disks, file systems, networking, languages, applications, containers, hypervisors, security, and the kernel. Gregg guides you from basic to advanced tools, helping you generate deeper, more useful technical insights for improving virtually any Linux system or application.

• Learn essential tracing concepts and both core BPF front-ends: BCC and bpftrace
• Master 150+ powerful BPF tools, including dozens created just for this book, and available for download
• Discover practical strategies, tips, and tricks for more effective analysis
• Analyze compiled, JIT-compiled, and interpreted code in multiple languages: C, Java, bash shell, and more
• Generate metrics, stack traces, and custom latency histograms
• Use complementary tools when they offer quick, easy wins
• Explore advanced tools built on BPF: PCP and Grafana for remote monitoring, eBPF Exporter, and kubectl-trace for tracing Kubernetes
• Foreword by Alexei Starovoitov, creator of the new BPF

BPF Performance Tools will be an indispensable resource for all administrators, developers, support staff, and other IT professionals working with any recent Linux distribution in any enterprise or cloud environment.

Brendan Gregg is a senior performance engineer at Netflix and a major contributor to BPF (eBPF), leading its use for observability. In the past fifteen years he has used BPF and prior tracers in many different production environments, and has published tools, visualizations, and books about his work. He has also developed and delivered training classes worldwide to teach performance analysis. He was the primary author of "DTrace: Dynamic Tracing in Oracle Solaris, Mac OS X, and FreeBSD" (2011), and the author of "Systems Performance: Enterprise and the Cloud" (2013). For the past five years he has been focused on BPF tracing, and has helped develop and maintain the main BPF front-ends, bcc and bpftrace, for which he created the reference guides and tutorials, and over seventy new BPF performance analysis tools, plus over eighty more for this book.

Part I: Technologies 1. Introduction 2. Technology Background 3. Performance Analysis 4. bcc 5. bpftrace
Part II: Using BPF Tools 6. CPUs 7. Memory 8. File Systems 9. Disk I/O 10. Networking 11. Security 12. Languages 13. Applications 14. Kernel 15. Containers 16. Hypervisors
Part III: Additional Topics 17. Other BPF Tools 18. Tips and Tricks
Appendices A. bpftrace One-Liners B. bpftrace Cheat Sheet C. bcc Tool Development
Glossary Bibliography