Building and maintaining complex distributed systems
June 19–20, 2017: Training
June 20–22, 2017: Tutorials & Conference
San Jose, CA

Linux performance monitoring with BPF

Sasha Goldshtein (Sela Group)
1:30pm–5:00pm Tuesday, June 20, 2017
Systems Engineering
Location: LL21 C/D
Level: Intermediate
Average rating: ****.
(4.40, 5 ratings)

Who is this presentation for?

  • Developers, SREs, performance engineers, production engineers, and system administrators

Prerequisite knowledge

  • Linux development and administration experience
  • Familiarity with Python and C (useful but not required)

Materials or downloads needed in advance

  • As an attendee, you will be using an online training environment with virtual machines provisioned on EC2. All you need is a web browser. If for some reason you would like to use a local VM, please follow the installation instructions.

What you'll learn

  • Learn how to install, extend, and use BPF tools in production environments
  • Understand how the BCC toolkit provides a holistic checklist for performance investigations and how to extend and build new tools when the baked-in ones don't cut it


eBPF (extended Berkeley Packet Filter) is a modern kernel technology that can be used to introduce dynamic tracing into a system that wasn’t prepared or instrumented in any way. The tracing programs run in the kernel, are guaranteed to never crash or hang your system, and can probe every module and function, from the kernel to user-space frameworks such as Node and Ruby.

Sasha Goldshtein leads a hands-on workshop on Linux dynamic tracing. You’ll explore the BPF Compiler Collection (BCC), a set of tools and libraries for dynamic tracing, and gain firsthand experience of memory leak analysis, generic function tracing, kernel tracepoints, static tracepoints in user-space programs, and the baked-in tools for file I/O, network, and CPU analysis. You’ll be able to choose between working on a set of hands-on labs prepared by the instructors or trying the tools out on your own test system.

You’ll then hack on some of the bleeding-edge tools in the BCC toolkit and build a couple of simple tools of your own, picking from a curated list of GitHub issues for the BCC project, a set of hands-on labs with known “school solutions,” and an open-ended list of problems that need tools for effective analysis. You’ll leave with a toolbox for diagnosing issues in the field and a framework for building your own tools when the generic ones do not suffice.

Photo of Sasha Goldshtein

Sasha Goldshtein

Sela Group

Sasha Goldshtein is the CTO of Sela Group, a Microsoft C# MVP and Azure MRS, a Pluralsight author, and an international consultant and trainer. Sasha’s consulting work revolves mainly around distributed architecture, production debugging, and mobile application development. Sasha is the author of Introducing Windows 7 for Developers (Microsoft Press) and Pro .NET Performance (Apress). He is also a prolific blogger and the author of numerous training courses, including .NET Debugging, .NET Performance, Android Application Development, and Modern C++.