Building and maintaining complex distributed systems
June 19–20, 2017: Training
June 20–22, 2017: Tutorials & Conference
San Jose, CA

Performance analysis superpowers with Linux eBPF

Brendan Gregg (Netflix)
3:40pm–4:20pm Thursday, June 22, 2017
Systems Engineering
Location: LL20 A/B
Level: Intermediate

Who is this presentation for?

  • DevOps engineers, developers, sysadmins, and performance engineers

Prerequisite knowledge

  • An understanding of existing Linux performance tools and their limitations (e.g., iostat, top, sar, etc.) and dynamic tracing

What you'll learn

  • Learn how to make use of the new built-in capabilities in Linux for performance analysis


Advanced performance observability and debugging have arrived in Linux 4.x, thanks to enhancements to Berkeley Packet Filter (eBPF) and the repurposing of its sandboxed virtual machine to provide programmatic capabilities to system tracing. Netflix has been looking into using eBPF for new observability tools, monitoring, security uses, and more. Brendan Gregg explores this new technology, which sooner or later will be available to everyone who uses Linux, offering a dive deep on Linux’s new tracing, observability, and debugging capabilities. Whether you’re doing analysis over an SSH session or via a monitoring GUI, BPF can be used to provide an efficient, custom, and deep level of detail into system and application performance.

Brendan also demonstrates the new open source tools that have been developed to make use of kernel- and user-level dynamic tracing (kprobes and uprobes) and kernel- and user-level static tracing (tracepoints). These tools provide new insights for filesystem and storage performance, CPU scheduler performance, TCP performance, and a whole lot more. This is a major turning point for Linux systems engineering, as custom advanced performance instrumentation can be used safely in production environments, powering a new generation of tools and visualizations.

Photo of Brendan Gregg

Brendan Gregg


Brendan Gregg is a senior performance architect at Netflix, where he does large-scale computer performance design, evaluation, analysis, and tuning. Previously, Brendan worked as a performance and kernel engineer. He has created performance analysis tools included in multiple operating systems, as well as visualizations and methodologies. Brendan is the author of Systems Performance. He received the USENIX LISA Award for outstanding achievement in system administration.