This article explains the technical principles behind Linux kernel tracing, covering static tracepoints and dynamic kprobes, demonstrating their use with ftrace and perf, and detailing the underlying macro implementations and low‑level mechanisms that make kernel source tracking possible.
This article explains how to locate and monitor kernel execution using IDE navigation, Linux tracing tools such as ftrace, perf, tracepoints, and kprobes, and dives into the underlying implementation details of static and dynamic tracing mechanisms.
This article outlines the standard BCC workflow for creating eBPF tools, then dissects the opensnoop source code, covering requirement analysis, kernel‑space program writing, BPF map configuration, user‑space Python integration, argument handling, testing, optimization, and deployment steps to monitor open system calls.
This article introduces tcpw, a small eBPF‑based utility that traces TCP, UDP, and Unix‑domain sockets to display the five‑tuple of commands like curl or telnet, explains its command‑line options, shows concrete usage examples, and details the underlying BPF and Go implementation, including connect, accept, and fork tracing.
This tutorial shows how to use eBPF, bpftrace, and the funclatency tool to instrument key Nginx functions, measure their execution latency, analyze the distribution of request processing times, and identify performance bottlenecks for optimization.
This article explains how to monitor MySQL slow queries by attaching eBPF uprobe/uretprobe probes to the dispatch_command function, handling symbol mangling across MySQL versions, and processing the captured data in a Go program to display latency and SQL statements.
bpftrace is a Linux eBPF‑based tracing tool that compiles scripts to BPF bytecode, offering kernel and user‑space probes; the guide covers its purpose, installation on major distros and Docker, and demonstrates built‑in example scripts for command logging, I/O latency, disk size, CPU usage, and TCP connection tracing.
This article explains how Linux tracing tools such as kprobes, uprobes, tracepoints, eBPF, perf, ftrace, sysdig, SystemTap and LTTng fit together, describing their data sources, collection mechanisms and front‑ends, and offers guidance on choosing the right tool for low‑overhead debugging and performance analysis.
This article walks through a real‑world investigation of excessive native memory usage in a Spring Boot application, detailing JVM settings, Linux‑level tracing, custom memory allocators, and the root cause in Spring Boot’s ZipInflaterInputStream, ultimately providing a fix and best‑practice recommendations.
