eBPF - Observability In Deep
•
2 likes•690 views
In the Cloud Native community, eBPF is gaining popularity, which can often be the best solution for solving different challenges with deep observability of system. Currently, eBPF is being embraced by major players. Mydbops co-Founder, Kabilesh P.R (MySQL and Mongo Consultant) illustrates on debugging linux issues with eBPF. A brief about BPF & eBPF, BPF internals and the tools in actions for faster resolution.
Report
Share
More Related Content
What's hot
What's hot (20)
Similar to eBPF - Observability In Deep
Similar to eBPF - Observability In Deep (20)
More from Mydbops
More from Mydbops (20)
Recently uploaded
Recently uploaded (20)
eBPF - Observability In Deep
- 1. Kabilesh P R Co-Founder, Mydbops October 3rd, 2020 Mydbops Database Meetup -7 EBPF Observability In Deep
- 2. Interested in Open Source technologies Building Solutions on MySQL, Cloud & MongoDB Active Tech Speaker/Blogger Co-Founder, Mydbops Kabilesh PR About Me
- 3. Consulting Services Managed Services Focuses on Top Opensource database MySQL, MongoDB and PostgreSQL Mydbops Services
- 4. 400 + Clients In 4 Yrs. of Operations Our Clients
- 5. Agenda BPF & EBPF BPF Internals Tools in action
- 6. BPF Vs EBPF BPF(Berkely Packet Filter) an "in-kernal VM" for packet filter developed in 1992 by Steven McCanne and Van Jacobson Introduced with the Linux Kernel 2.1.75 in 1997 EBPF(Extended BPF), has been there from 2014 with LinuX kernel from version 3.15... It's no more a acronym, Since it not only does packet filtering
- 7. Pre BPF Analysis 1. uptime 2. dmesg -T | tail 3. vmstat 1 4. mpstat -P ALL 1 5. pidstat 1 6. iostat -xdz 1 7. free -m 8. sar -n DEV 1 9. sar -n TCP,ETCP 1 10. top Mostly based on the procfs (/proc) -- post-process manner
- 8. What is BPF eBPF can prepare user information in kernel context and transfer only needed information to user space. So far, support of kprobes, tracepoints, uprobes and perf_events filtering using eBPF have been implemented in the upstream kernel A user can interact with the eBPF kernel using a bpf() system call whose prototype is: int bpf(int cmd, union bpf_attr *attr, unsigned int size); eBPF is a revolutionary technology that can run sandboxed programs in the Linux kernel without changing kernel source code or loading kernel modules. By making the Linux kernel programmable, infrastructure software can leverage existing layers, making them more intelligent and feature-rich without continuing to add additional layers of complexity to the system (Dynamic tracing)
- 9. update to modify the data). Microkernel model
- 10. Development is being actively done later is better Execution Plan Analysis Linux Kernel support for eBPF
- 11. Improvements with Kernel Versions
- 12. BPF Internals
- 13. BPF Internals
- 14. BPF instruction are verified against end-loop and sanity (Verifier) Interpretor/Compiler uses GCC/LVM compiler Just-in-time (JIT) compiler translates eBPF bytecode into a host system's assembly code Registers to store instructions eBPF uses map as generic key/value data structure for data transfer between Kernel and user space BPF Internals
- 15. BPF Internals
- 16. Current State of BPF
- 18. Closer view of Sub-Systems CPU (Scheduling) Memory Disks File Systems Networking Applications Kernel Hypervisors Containers
- 19. Newer Kernal is better, Great to have > 4.4 https://github.com/iovisor/bcc/blob/master/INSTALL.md (choose according to the version) Installation Ubuntu Package Ubuntu Packages Source packages and the binary packages produced from them can be found at packages.ubuntu.com. #sudo apt-get install bpfcc-tools linux-headers-$(uname -r) The tools are installed in /sbin (/usr/sbin in Ubuntu 18.04) with a -bpfcc extension. Try running sudo opensnoop-bpfcc.
- 20. Iovisor: BPF Compiler Collection (BCC). BCC is a toolkit for creating efficient kernel tracing and manipulation programs, and includes several useful tools Installation Installation Ubuntu #sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 4052245BD4284CDD #echo "deb https://repo.iovisor.org/apt/$(lsb_release -cs) $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/iovisor.list #sudo apt-get update #sudo apt-get install bcc-tools libbcc-examples linux-headers-$(uname - r)
- 21. Installation Installation Centos8 With Centos8, the package comes with the default repo #yum install bcc-tools Location: /usr/share/bcc/tools
- 22. Tools In Action
- 23. GUI tools Cloud-Flare has developed a open-source exporter around EPBF tool to ingest data to prometheus and Grafana for visualisation PMM also supports EBPF with external exporter support Netflix has their own GUI tool called Vector built on top of EBPF Many more enhancements are in progress
- 25. Reach Us : Info@mydbops.com Thank You