eBPF (extended Berkeley Packet Filter) is a modern kernel technology that can be used to introduce dynamic tracing into a system that wasn’t prepared or instrumented in any way. The tracing programs run in the kernel, are guaranteed to never crash or hang your system, and can probe every module and function, from the kernel to user-space frameworks such as Node and Ruby.
Sasha Goldshtein leads a hands-on workshop on Linux dynamic tracing. You’ll explore the BPF Compiler Collection (BCC), a set of tools and libraries for dynamic tracing, and gain firsthand experience of memory leak analysis, generic function tracing, kernel tracepoints, static tracepoints in user-space programs, and the baked-in tools for file I/O, network, and CPU analysis. You’ll be able to choose between working on a set of hands-on labs prepared by the instructors or trying the tools out on your own test system.
You’ll then hack on some of the bleeding-edge tools in the BCC toolkit and build a couple of simple tools of your own, picking from a curated list of GitHub issues for the BCC project, a set of hands-on labs with known “school solutions,” and an open-ended list of problems that need tools for effective analysis. You’ll leave with a toolbox for diagnosing issues in the field and a framework for building your own tools when the generic ones do not suffice.
Sasha Goldshtein is the CTO of Sela Group, a Microsoft C# MVP and Azure MRS, a Pluralsight author, and an international consultant and trainer. Sasha’s consulting work revolves mainly around distributed architecture, production debugging, and mobile application development. Sasha is the author of Introducing Windows 7 for Developers (Microsoft Press) and Pro .NET Performance (Apress). He is also a prolific blogger and the author of numerous training courses, including .NET Debugging, .NET Performance, Android Application Development, and Modern C++.
©2017, O'Reilly Media, Inc. • (800) 889-8969 or (707) 827-7019 • Monday-Friday 7:30am-5pm PT • All trademarks and registered trademarks appearing on oreilly.com are the property of their respective owners. • firstname.lastname@example.org