This article demonstrates how to use eBPF to audit fileless command‑execution attacks and reverse‑shell techniques by tracing memfd_create, Kprobe/LSM hooks, dup2 redirections, and related kernel functions, providing concrete code examples and analysis of the detection logic.
This guide explains how to leverage eBPF’s Kprobe, Tracepoint, and LSM features to audit file read/write activity, extract process and file details, and optionally block operations using helpers like bpf_send_signal or bpf_override_return, with complete code examples and configuration steps.
The article explains how attackers exploit SUID binaries for privilege escalation and demonstrates how to use eBPF LSM hooks (file_open, bprm_check_security) and Kprobe tracing to audit such operations, then shows how to block them by returning error codes while exempting root users.
This article presents a comprehensive overview of Apache Paimon, covering the concept of real‑time lakehouses, the underlying technologies such as LSM and merge‑on‑write, practical application cases across enterprises, and the latest frontier features like tags, branches, and advanced indexing, illustrating how Paimon bridges batch and streaming workloads in modern big‑data ecosystems.
This article explains ClickHouse’s columnar, MPP‑based design, block compression, LSM pre‑sorting, sparse and skip‑list indexing, and vectorized execution, while also discussing its high‑frequency write challenges, concurrency limits, and production‑grade issues such as Zookeeper load and resource management.
The article investigates why BPF LSM programs fail to load on aarch64 kernels, uses ftrace‑based tools such as bpftrace and trace‑cmd to trace kernel execution, discovers missing arch_prepare_bpf_trampoline support in 5.15 and 6.1, and shows that a patch merged into the mainline kernel restores functionality for upcoming releases.
This article presents the architecture, core challenges, key design decisions, and future directions of Alibaba Cloud's SLS platform, which handles billions of daily log queries with sub‑300 ms latency by leveraging LSM‑based storage, indexing, columnar layout, distributed caching, and multi‑tenant isolation.
Apache Paimon is an open‑source streaming data lake storage system that combines LSM‑based real‑time updates, open file formats, and deep integration with Flink, Spark, and Trino to deliver high‑throughput ingestion, low‑latency queries, and unified batch‑stream processing for modern big‑data workloads.
Apache Paimon, newly incubated by the Apache Software Foundation, combines Flink's real‑time streaming capabilities with open lakehouse storage formats, offering high‑throughput, low‑latency data ingestion, partial‑update merges, and seamless integration with engines like Flink, Spark, and Trino for unified batch and streaming analytics.
The article explains how ClickHouse uses block‑based batch processing combined with LSM‑style pre‑sorting and columnar compression to accelerate range queries on massive datasets, while also discussing the trade‑offs such as write latency and limitations for transactional workloads.
The article explains the Linux Security Module (LSM) framework, detailing its origins, hook‑based architecture, kernel integration points, initialization process, and how it enables flexible, non‑intrusive security enhancements such as SELinux, allowing multiple security modules to coexist within the Linux kernel.
The article details WeChat Search’s practical distributed architecture—using a Chubby‑elected leader for shard‑to‑node mapping, hash‑based sharding with dynamic rebalancing, a Lambda‑style batch and near‑real‑time indexing pipeline, relaxed monotonic consistency, and group‑based searcher scaling—to illustrate trade‑offs and lessons for building scalable, reliable search services.
This article explains HBase compaction—a key operation in the Log‑Structured Merge‑Tree model—covering minor and major compaction differences, trigger conditions, configuration parameters, selection algorithms, thread‑pool handling, and the effects on read and write performance in a big‑data database environment.
This article summarizes a Cassandra meetup presentation that traces the database's origins from BigTable and Dynamo, outlines its key milestones, explains its peer‑to‑peer and LSM architecture, highlights current features, real‑world deployments, performance advantages, and previews upcoming 4.0 releases and community projects.
This article provides an in‑depth technical overview of Alibaba's X‑Engine storage engine, explaining its LSM‑based architecture, compaction optimizations, transaction pipeline, caching strategies, and how these innovations enable low‑cost, high‑throughput OLTP for large‑scale e‑commerce workloads.
This article explains how disk I/O performance is shaped by page cache behavior, sequential versus random access, elevator scheduling, and storage data structures such as B+Tree and LSM trees, showing why operating systems and databases must design for sequential reads and writes to achieve optimal throughput.
This article examines the trade‑offs of LSM‑based storage engines on SSDs, highlighting write amplification issues, the benefits of separating keys from values via the WiscKey approach, and the challenges of range queries, garbage collection, and crash consistency.
This article examines the evolution and challenges of time‑series storage, compares file‑based, LSM‑tree, and B‑tree approaches, and proposes a vector‑based method to efficiently handle writes, reads, query semantics, dimensions, and aggregation for modern big‑data applications.
The article introduces SessionDB, a Java‑implemented, LSM‑tree‑based key/value storage engine designed to eliminate sticky sessions by providing high‑throughput, durable, and scalable session data handling, and details its architecture, optimizations, sharding strategy, and benchmark comparisons with BerkeleyDB, LevelDB, and RocksDB.
