Get deeper insights into your system with eBPF

Keen Observer

© Lead Image © Ioannis Kounadeas,

© Lead Image © Ioannis Kounadeas,

Article from Issue 225/2019

Use the eBPF in-kernel virtual machine to identify resource bottlenecks and optimize your installation.

eBPF [1] is a relatively new addition to the Linux kernel that takes over more monitoring, security, and networking duties from individual kernel modules. Originally called the Berkeley Packet Filter, BPF came to life in 1992 [2] in order to provide a better and optimized mechanism to filter packets.

BPF was first used as an HTTP packet filter in BSD. Several decades later, it was completely rehashed and took on new tasks. The new version of BPF is what is known as enhanced BPF or eBPF. In addition to various new features, eBPF also has a new mechanism to connect to the Linux kernel. Instead of just redirecting packets, eBPF can attach itself to any kernel event or any socket. eBPF is tightly integrated with the Linux kernel and can be used as an efficient mechanism for Linux tracing. You can also use eBPF behind the scenes on your Linux machines to discover performance issues and bottlenecks.

Get Started

eBPF requires a kernel newer than v4.4 and one that has been compiled with the CONFIG_BPF_SYSCALL option. Neither of these requirements should be a problem if you are using one of the mainstream distributions like Ubuntu and updating it regularly.


Use Express-Checkout link below to read the full article (PDF).

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Open Heart Surgery

    Who is constantly creating the new processes that are paralyzing the system? Which process opens the most files and how many bytes is it reading or writing? Mike Schilli pokes inside the kernel to answer these questions with bpftrace and its code probes.

  • perf

    The kernel supports performance analysis with built-in tools via the Linux performance counters subsystem. perf is easy to use and offers a detailed view of performance data.

  • This Month's DVD

    Arch Linux and CentOS 8.0.1905

  • Charly's Column

    Some people don’t mind leaving traces of their IP address wherever they go, others prefer to use a tool like The Onion Router.

  • Tracing Tools

    Programs rarely reveal what they are doing in the background, but a few clever tools, of interest to both programmers and administrators, monitor this activity and log system functions.

comments powered by Disqus

Direct Download

Read full article as PDF:

Price $2.95