book

Linux Observability with BPF

by David Calavera, Lorenzo Fontana

November 2019

Intermediate to advanced

177 pages

4h 39m

English

O'Reilly Media, Inc.

Read now

Unlock full access

Conventions Used in This BookUsing Code ExamplesO’Reilly Online LearningHow to Contact UsAcknowledgments
BPF’s HistoryArchitectureConclusion
Writing BPF ProgramsBPF Program TypesSocket Filter ProgramsKprobe ProgramsTracepoint ProgramsXDP ProgramsPerf Event ProgramsCgroup Socket ProgramsCgroup Open Socket ProgramsSocket Option ProgramsSocket Map ProgramsCgroup Device ProgramsSocket Message Delivery ProgramsRaw Tracepoint ProgramsCgroup Socket Address ProgramsSocket Reuseport ProgramsFlow Dissection ProgramsOther BPF ProgramsThe BPF VerifierBPF Type FormatBPF Tail CallsConclusion
Creating BPF MapsELF Conventions to Create BPF MapsWorking with BFP MapsUpdating Elements in a BPF MapReading Elements from a BPF MapRemoving an Element from a BPF MapIterating Over Elements in a BPF MapLooking Up and Deleting ElementsConcurrent Access to Map ElementsTypes of BPF MapsHash-Table MapsArray MapsProgram Array MapsPerf Events Array MapsPer-CPU Hash MapsPer-CPU Array MapsStack Trace MapsCgroup Array MapsLRU Hash and Per-CPU Hash MapsLPM Trie MapsArray of Maps and Hash of MapsDevice Map MapsCPU Map MapsOpen Socket MapsSocket Array and Hash MapsCgroup Storage and Per-CPU Storage MapsReuseport Socket MapsQueue MapsStack MapsThe BPF Virtual FilesystemConclusion
ProbesKernel ProbesTracepointsUser-Space ProbesUser Statically Defined TracepointsVisualizing Tracing DataFlame GraphsHistogramsPerf EventsConclusion
BPFToolInstallationFeature DisplayInspecting BPF ProgramsInspecting BPF MapsInspecting Programs Attached to Specific InterfacesLoading Commands in Batch ModeDisplaying BTF InformationBPFTraceInstallationLanguage ReferenceFilteringDynamic Mappingkubectl-traceInstallationInspecting Kubernetes NodeseBPF ExporterInstallationExporting Metrics from BPFConclusion
BPF and Packet Filteringtcpdump and BPF ExpressionsPacket Filtering for Raw SocketsBPF-Based Traffic Control ClassifierTerminologyTraffic Control Classifier Program Using cls_bpfDifferences Between Traffic Control and XDPConclusion
XDP Programs OverviewOperation ModesThe Packet ProcessorXDP and iproute2 as a LoaderXDP and BCCTesting XDP ProgramsXDP Testing Using the Python Unit Testing FrameworkXDP Use CasesMonitoringDDoS MitigationLoad BalancingFirewallingConclusion
CapabilitiesSeccompSeccomp ErrorsSeccomp BPF Filter ExampleBPF LSM HooksConclusion

Sysdig eBPF God ModeFlowmill

Content preview from Linux Observability with BPF

Index

A

action blocks (BPFTrace), Language Reference
- associating a filter with, Filtering
act_bpf versus cls_bpf, Notes on act_bpf and how cls_bpf is different
ambient capabilities, Capabilities
application binary interface (ABI), kernel probes and, Kernel Probes
argument helpers (in BPFTrace), Language Reference
array maps, Array Maps, The BPF program
- attaching to and looking up elements, Load and attach to a network interface
- per-cpu, XDP and BCC
array of maps, Array of Maps and Hash of Maps

B

batch mode, loading commands in (BPFTool), Loading Commands in Batch Mode
BCC (BPF Compiler Collection), Tracing with BPF
- capable tool, Capabilities
- histogram visualizing latency from loading BPF programs, Histograms
- initialization of BPF programs, limitation of, Flame Graphs
- prerequisite for eBPF Exporter installation, Installation
- profiler and visualization tools, Flame Graphs
- Python frontend, using, Kprobes
- sym helper, Flame Graphs
- tplist tool, User Statically Defined Tracepoints
- using with XDP programs, XDP and BCC-XDP and BCC
BEGIN and END keywords (BPFTrace), Language Reference
Berkeley Packet Filter (see BPF)
black swan, Introduction
BPF, Introduction
- architecture within the kernel, Architecture
- finding tracepoints for, Tracepoints
- history of, BPF’s History
- LSM hooks, BPF LSM Hooks
- program types, BPF Program Types-Other BPF Programs
- real-world use cases, Real-World Use Cases-Flowmill
  - Flowmill, Flowmill-Flowmill
  - Sysdig eBPF God mode, Sysdig eBPF God Mode-Sysdig eBPF God Mode
BPF (Berkeley Packet Filter)
BPF Compiler ...