#bpftrace — Public Fediverse posts

Kprobes и где они обитают

Про eBPF уже сказано и написано достаточно много, поэтому я хочу сделать следующий шаг и чуть глубже рассмотреть практические аспекты работы c таким механизмом, как kprobe , который позволяет использовать функции ядра Linux для динамического запуска пользовательского кода. Статья поможет ответить на вопросы: - Как понять, какую функцию ядра выбрать для использования с механизмом kprobe? - С чего начать ее поиск? - Какими инструментами пользоваться? kprobe — это, по сути, ловушка, или брейкпоинт, который можно установить почти в любом месте кода ядра Linux.

https://habr.com/ru/companies/pt/articles/972442/

#ebpf #kprobes #linux #linux_kernel #container_security #контейнеризация #tetragon #ftrace #bpftrace #open_source

Kprobes и где они обитают

Про eBPF уже сказано и написано достаточно много, поэтому я хочу сделать следующий шаг и чуть глубже рассмотреть практические аспекты работы c таким механизмом, как kprobe , который позволяет использовать функции ядра Linux для динамического запуска пользовательского кода. Статья поможет ответить на вопросы: - Как понять, какую функцию ядра выбрать для использования с механизмом kprobe? - С чего начать ее поиск? - Какими инструментами пользоваться? kprobe — это, по сути, ловушка, или брейкпоинт, который можно установить почти в любом месте кода ядра Linux.

https://habr.com/ru/companies/pt/articles/972442/

#ebpf #kprobes #linux #linux_kernel #container_security #контейнеризация #tetragon #ftrace #bpftrace #open_source

Kprobes и где они обитают

Про eBPF уже сказано и написано достаточно много, поэтому я хочу сделать следующий шаг и чуть глубже рассмотреть практические аспекты работы c таким механизмом, как kprobe , который позволяет использовать функции ядра Linux для динамического запуска пользовательского кода. Статья поможет ответить на вопросы: - Как понять, какую функцию ядра выбрать для использования с механизмом kprobe? - С чего начать ее поиск? - Какими инструментами пользоваться? kprobe — это, по сути, ловушка, или брейкпоинт, который можно установить почти в любом месте кода ядра Linux.

https://habr.com/ru/companies/pt/articles/972442/

#ebpf #kprobes #linux #linux_kernel #container_security #контейнеризация #tetragon #ftrace #bpftrace #open_source

#nextest now has support for USDT probes with #DTrace and #bpftrace, and it's so cool!

https://nexte.st/docs/integrations/usdt/

#nextest now has support for USDT probes with #DTrace and #bpftrace, and it's so cool!

https://nexte.st/docs/integrations/usdt/

#nextest now has support for USDT probes with #DTrace and #bpftrace, and it's so cool!

https://nexte.st/docs/integrations/usdt/

#nextest now has support for USDT probes with #DTrace and #bpftrace, and it's so cool!

https://nexte.st/docs/integrations/usdt/

#nextest now has support for USDT probes with #DTrace and #bpftrace, and it's so cool!

https://nexte.st/docs/integrations/usdt/

🐧🐝 Learn essential eBPF #Linux command line tools to improve your service observability with #opensource: https://t.ly/wNy6b

Check out #Coroot (we’re #FOSS!) to turn manual service analysis into instant root cause insights. Resolve issues and deploy faster with #eBPF: https://n9.cl/kfm0rw

#BPFtrace #BPF #kernel #freesoftware #FLOSS #SRE #DevOps #Coroot #tech #IT #kubernetes

🐧🐝 Learn essential eBPF #Linux command line tools to improve your service observability with #opensource: https://t.ly/wNy6b

Check out #Coroot (we’re #FOSS!) to turn manual service analysis into instant root cause insights. Resolve issues and deploy faster with #eBPF: https://n9.cl/kfm0rw

#BPFtrace #BPF #kernel #freesoftware #FLOSS #SRE #DevOps #Coroot #tech #IT #kubernetes

🐧🐝 Learn essential eBPF #Linux command line tools to improve your service observability with #opensource: https://t.ly/wNy6b

Check out #Coroot (we’re #FOSS!) to turn manual service analysis into instant root cause insights. Resolve issues and deploy faster with #eBPF: https://n9.cl/kfm0rw

#BPFtrace #BPF #kernel #freesoftware #FLOSS #SRE #DevOps #Coroot #tech #IT #kubernetes

🐧🐝 Learn essential eBPF #Linux command line tools to improve your service observability with #opensource: https://t.ly/wNy6b

Check out #Coroot (we’re #FOSS!) to turn manual service analysis into instant root cause insights. Resolve issues and deploy faster with #eBPF: https://n9.cl/kfm0rw

#BPFtrace #BPF #kernel #freesoftware #FLOSS #SRE #DevOps #Coroot #tech #IT #kubernetes

🐧🐝 Learn essential eBPF #Linux command line tools to improve your service observability with #opensource: https://t.ly/wNy6b

Check out #Coroot (we’re #FOSS!) to turn manual service analysis into instant root cause insights. Resolve issues and deploy faster with #eBPF: https://n9.cl/kfm0rw

#BPFtrace #BPF #kernel #freesoftware #FLOSS #SRE #DevOps #Coroot #tech #IT #kubernetes

Is there a way to detect #bpftrace version in in its preprocessor in order to support different versions of syntax? The delete syntax changed recently and that breaks a lot of my scripts...

#ebpf #osdev #linux

Is there a way to detect #bpftrace version in in its preprocessor in order to support different versions of syntax? The delete syntax changed recently and that breaks a lot of my scripts...

#ebpf #osdev #linux

Is there a way to detect #bpftrace version in in its preprocessor in order to support different versions of syntax? The delete syntax changed recently and that breaks a lot of my scripts...

#ebpf #osdev #linux

Is there a way to detect #bpftrace version in in its preprocessor in order to support different versions of syntax? The delete syntax changed recently and that breaks a lot of my scripts...

#ebpf #osdev #linux

Is there a way to detect #bpftrace version in in its preprocessor in order to support different versions of syntax? The delete syntax changed recently and that breaks a lot of my scripts...

#ebpf #osdev #linux

@foone A port of #doom to #linux #bpftrace
https://lpc.events/event/18/contributions/1936/

@foone A port of #doom to #linux #bpftrace
https://lpc.events/event/18/contributions/1936/

@foone A port of #doom to #linux #bpftrace
https://lpc.events/event/18/contributions/1936/

@foone A port of #doom to #linux #bpftrace
https://lpc.events/event/18/contributions/1936/

I was playing with an MDM solution (mobile device management), and looking at why it did not support Ubuntu 24.04 yet (works on 22.04); unfortunately it uses malware-like techniques of execve-ing shell scripts from a memfd.

Here is how to get the script with bpftrace's execsnoop (could also work with iovisor's or libbpf's):

sudo execsnoop.bt | stdbuf -o0  grep proc/self/fd | awk -W interactive '{system("sudo cat /proc/"$2"/fd/"substr($4, 15)) }'

(it did not take me 45 minutes to re-discover mawk's -W interactive )

I could then analyze the script and discovered that a change in behaviour in jq 1.7 was the source of the issue. Minimal reproducer:

> jq --version; printf "a\0b\0" | jq -Rsc 'split("\u0000")'
jq-1.6
["a","b"]
> jq --version; printf "a\0b\0" | jq -Rsc 'split("\u0000")'
jq-1.7
["a","b",""]

(I won't be reporting to jq upstream, because I don't really care about whether or not this is a regression or a fix)

#eBPF #mdm #ubuntu #jq #awk #bpftrace

I was playing with an MDM solution (mobile device management), and looking at why it did not support Ubuntu 24.04 yet (works on 22.04); unfortunately it uses malware-like techniques of execve-ing shell scripts from a memfd.

Here is how to get the script with bpftrace's execsnoop (could also work with iovisor's or libbpf's):

sudo execsnoop.bt | stdbuf -o0  grep proc/self/fd | awk -W interactive '{system("sudo cat /proc/"$2"/fd/"substr($4, 15)) }'

(it did not take me 45 minutes to re-discover mawk's -W interactive )

I could then analyze the script and discovered that a change in behaviour in jq 1.7 was the source of the issue. Minimal reproducer:

> jq --version; printf "a\0b\0" | jq -Rsc 'split("\u0000")'
jq-1.6
["a","b"]
> jq --version; printf "a\0b\0" | jq -Rsc 'split("\u0000")'
jq-1.7
["a","b",""]

(I won't be reporting to jq upstream, because I don't really care about whether or not this is a regression or a fix)

#eBPF #mdm #ubuntu #jq #awk #bpftrace

I was playing with an MDM solution (mobile device management), and looking at why it did not support Ubuntu 24.04 yet (works on 22.04); unfortunately it uses malware-like techniques of execve-ing shell scripts from a memfd.

Here is how to get the script with bpftrace's execsnoop (could also work with iovisor's or libbpf's):

sudo execsnoop.bt | stdbuf -o0  grep proc/self/fd | awk -W interactive '{system("sudo cat /proc/"$2"/fd/"substr($4, 15)) }'

(it did not take me 45 minutes to re-discover mawk's -W interactive )

I could then analyze the script and discovered that a change in behaviour in jq 1.7 was the source of the issue. Minimal reproducer:

> jq --version; printf "a\0b\0" | jq -Rsc 'split("\u0000")'
jq-1.6
["a","b"]
> jq --version; printf "a\0b\0" | jq -Rsc 'split("\u0000")'
jq-1.7
["a","b",""]

(I won't be reporting to jq upstream, because I don't really care about whether or not this is a regression or a fix)

#eBPF #mdm #ubuntu #jq #awk #bpftrace

I was playing with an MDM solution (mobile device management), and looking at why it did not support Ubuntu 24.04 yet (works on 22.04); unfortunately it uses malware-like techniques of execve-ing shell scripts from a memfd.

Here is how to get the script with bpftrace's execsnoop (could also work with iovisor's or libbpf's):

sudo execsnoop.bt | stdbuf -o0  grep proc/self/fd | awk -W interactive '{system("sudo cat /proc/"$2"/fd/"substr($4, 15)) }'

(it did not take me 45 minutes to re-discover mawk's -W interactive )

I could then analyze the script and discovered that a change in behaviour in jq 1.7 was the source of the issue. Minimal reproducer:

> jq --version; printf "a\0b\0" | jq -Rsc 'split("\u0000")'
jq-1.6
["a","b"]
> jq --version; printf "a\0b\0" | jq -Rsc 'split("\u0000")'
jq-1.7
["a","b",""]

(I won't be reporting to jq upstream, because I don't really care about whether or not this is a regression or a fix)

#eBPF #mdm #ubuntu #jq #awk #bpftrace

I was playing with an MDM solution (mobile device management), and looking at why it did not support Ubuntu 24.04 yet (works on 22.04); unfortunately it uses malware-like techniques of execve-ing shell scripts from a memfd.

Here is how to get the script with bpftrace's execsnoop (could also work with iovisor's or libbpf's):

sudo execsnoop.bt | stdbuf -o0  grep proc/self/fd | awk -W interactive '{system("sudo cat /proc/"$2"/fd/"substr($4, 15)) }'

(it did not take me 45 minutes to re-discover mawk's -W interactive )

I could then analyze the script and discovered that a change in behaviour in jq 1.7 was the source of the issue. Minimal reproducer:

> jq --version; printf "a\0b\0" | jq -Rsc 'split("\u0000")'
jq-1.6
["a","b"]
> jq --version; printf "a\0b\0" | jq -Rsc 'split("\u0000")'
jq-1.7
["a","b",""]

(I won't be reporting to jq upstream, because I don't really care about whether or not this is a regression or a fix)

#eBPF #mdm #ubuntu #jq #awk #bpftrace

I wrote a profiler for process lifecycle events, and you can read about it here: https://tinkering.xyz/proctrace/

It's written in #Rust and uses #eBPF under the hood (via #bpftrace). There's a macOS bug that prevents us from using DTrace at the moment. But you can record processes on #Linux and process the recording on macOS.

The code is at https://github.com/zmitchell/proctrace and the documentation site is at https://proctrace.xyz

I wrote a profiler for process lifecycle events, and you can read about it here: https://tinkering.xyz/proctrace/

It's written in #Rust and uses #eBPF under the hood (via #bpftrace). There's a macOS bug that prevents us from using DTrace at the moment. But you can record processes on #Linux and process the recording on macOS.

The code is at https://github.com/zmitchell/proctrace and the documentation site is at https://proctrace.xyz

I wrote a profiler for process lifecycle events, and you can read about it here: https://tinkering.xyz/proctrace/

It's written in #Rust and uses #eBPF under the hood (via #bpftrace). There's a macOS bug that prevents us from using DTrace at the moment. But you can record processes on #Linux and process the recording on macOS.

The code is at https://github.com/zmitchell/proctrace and the documentation site is at https://proctrace.xyz

I wrote a profiler for process lifecycle events, and you can read about it here: https://tinkering.xyz/proctrace/

It's written in #Rust and uses #eBPF under the hood (via #bpftrace). There's a macOS bug that prevents us from using DTrace at the moment. But you can record processes on #Linux and process the recording on macOS.

The code is at https://github.com/zmitchell/proctrace and the documentation site is at https://proctrace.xyz

I wrote a profiler for process lifecycle events, and you can read about it here: https://tinkering.xyz/proctrace/

It's written in #Rust and uses #eBPF under the hood (via #bpftrace). There's a macOS bug that prevents us from using DTrace at the moment. But you can record processes on #Linux and process the recording on macOS.

The code is at https://github.com/zmitchell/proctrace and the documentation site is at https://proctrace.xyz

The year is 2024 and bpftrace crashes when there's an extra whitespace.

bpftrace is DTrace 2.0? DTrace my ass. I've never seen DTrace crash because of an extra whitespace.

Hell, I've never seen DTrace crash, ever.

#DTrace #bpftrace #Unix #Linux #sysadmin #illumos

The year is 2024 and bpftrace crashes when there's an extra whitespace.

bpftrace is DTrace 2.0? DTrace my ass. I've never seen DTrace crash because of an extra whitespace.

Hell, I've never seen DTrace crash, ever.

#DTrace #bpftrace #Unix #Linux #sysadmin #illumos

The year is 2024 and bpftrace crashes when there's an extra whitespace.

bpftrace is DTrace 2.0? DTrace my ass. I've never seen DTrace crash because of an extra whitespace.

Hell, I've never seen DTrace crash, ever.

#DTrace #bpftrace #Unix #Linux #sysadmin #illumos

The year is 2024 and bpftrace crashes when there's an extra whitespace.

bpftrace is DTrace 2.0? DTrace my ass. I've never seen DTrace crash because of an extra whitespace.

Hell, I've never seen DTrace crash, ever.

#DTrace #bpftrace #Unix #Linux #sysadmin #illumos

The year is 2024 and bpftrace crashes when there's an extra whitespace.

bpftrace is DTrace 2.0? DTrace my ass. I've never seen DTrace crash because of an extra whitespace.

Hell, I've never seen DTrace crash, ever.

#DTrace #bpftrace #Unix #Linux #sysadmin #illumos

PPAs Updates

Latest versions of BCC (v0.29.1) and libbpf (v1.3.0) are now available from the bpftrace PPA for bionic, focal and jammy. There's also latest bpftrace (0.19.0) available but only for jammy (I [...]

🔗 https://chbk.co/GdMhw

#ubuntu #bpfcc #bcc #bpftrace #libbpf

PPAs Updates

Latest versions of BCC (v0.29.1) and libbpf (v1.3.0) are now available from the bpftrace PPA for bionic, focal and jammy. There's also latest bpftrace (0.19.0) available but only for jammy (I [...]

🔗 https://chbk.co/GdMhw

#ubuntu #bpfcc #bcc #bpftrace #libbpf

PPAs Updates

Latest versions of BCC (v0.29.1) and libbpf (v1.3.0) are now available from the bpftrace PPA for bionic, focal and jammy. There's also latest bpftrace (0.19.0) available but only for jammy (I [...]

🔗 https://chbk.co/GdMhw

#ubuntu #bpfcc #bcc #bpftrace #libbpf

PPAs Updates

Latest versions of BCC (v0.29.1) and libbpf (v1.3.0) are now available from the bpftrace PPA for bionic, focal and jammy. There's also latest bpftrace (0.19.0) available but only for jammy (I [...]

🔗 https://chbk.co/GdMhw

#ubuntu #bpfcc #bcc #bpftrace #libbpf

PPAs Updates

Latest versions of BCC (v0.29.1) and libbpf (v1.3.0) are now available from the bpftrace PPA for bionic, focal and jammy. There's also latest bpftrace (0.19.0) available but only for jammy (I [...]

🔗 https://chbk.co/GdMhw

#ubuntu #bpfcc #bcc #bpftrace #libbpf

New cool example for ebpf_exporter: CFS delay histogram. In addition to knowing overall CFS throttlig delay from cgroups in cpu.state, now you can have a histogram of individual throttling durations in prometheus.

* https://github.com/cloudflare/ebpf_exporter/pull/311

As a bonus, you get a bpftrace command to observe these.

#ebpf #ebpf_exporter #cgroups #cfs #bpftrace #prometheus

New cool example for ebpf_exporter: CFS delay histogram. In addition to knowing overall CFS throttlig delay from cgroups in cpu.state, now you can have a histogram of individual throttling durations in prometheus.

* https://github.com/cloudflare/ebpf_exporter/pull/311

As a bonus, you get a bpftrace command to observe these.

#ebpf #ebpf_exporter #cgroups #cfs #bpftrace #prometheus

New cool example for ebpf_exporter: CFS delay histogram. In addition to knowing overall CFS throttlig delay from cgroups in cpu.state, now you can have a histogram of individual throttling durations in prometheus.

* https://github.com/cloudflare/ebpf_exporter/pull/311

As a bonus, you get a bpftrace command to observe these.

#ebpf #ebpf_exporter #cgroups #cfs #bpftrace #prometheus

New cool example for ebpf_exporter: CFS delay histogram. In addition to knowing overall CFS throttlig delay from cgroups in cpu.state, now you can have a histogram of individual throttling durations in prometheus.

* https://github.com/cloudflare/ebpf_exporter/pull/311

As a bonus, you get a bpftrace command to observe these.

#ebpf #ebpf_exporter #cgroups #cfs #bpftrace #prometheus

New cool example for ebpf_exporter: CFS delay histogram. In addition to knowing overall CFS throttlig delay from cgroups in cpu.state, now you can have a histogram of individual throttling durations in prometheus.

* https://github.com/cloudflare/ebpf_exporter/pull/311

As a bonus, you get a bpftrace command to observe these.

#ebpf #ebpf_exporter #cgroups #cfs #bpftrace #prometheus

Today I used #bpftrace on a #Linux system to investigate a performance issue. Really took me back to my days working on #Solaris at Sun Microsystems. I used #dtrace quite a bit at that time, and it's good to see the same good ideas thriving in Linux.

I worked in #AIX development at #IBM for many years, and I was always a little sad that people didn't use #probevue more. Perhaps this is because AIX has a good system trace infrastructure and the culture grew up using that. Hard to say.

Today I used #bpftrace on a #Linux system to investigate a performance issue. Really took me back to my days working on #Solaris at Sun Microsystems. I used #dtrace quite a bit at that time, and it's good to see the same good ideas thriving in Linux.

I worked in #AIX development at #IBM for many years, and I was always a little sad that people didn't use #probevue more. Perhaps this is because AIX has a good system trace infrastructure and the culture grew up using that. Hard to say.

Today I used #bpftrace on a #Linux system to investigate a performance issue. Really took me back to my days working on #Solaris at Sun Microsystems. I used #dtrace quite a bit at that time, and it's good to see the same good ideas thriving in Linux.

I worked in #AIX development at #IBM for many years, and I was always a little sad that people didn't use #probevue more. Perhaps this is because AIX has a good system trace infrastructure and the culture grew up using that. Hard to say.