LINUX OBSERVABILITY WITH BPF

by David Calavera

Want to master the BPF virtual machine in the Linux Kernel? This practical guide shows you how to write applications that use BPF to observe and modify the kernel's behavior on demand--without having prior knowledge of Linux Kernel development. David Calavera and Lorenzo Fontana introduce concepts to help systems engineers understand the BPF program lifecycle.If you have knowledge about performance optimization, networking, and security, this book shows you how to inject code to monitor, trace, and observe events in the kernel in a secure way--without the need to recompile the kernel or reboot the system. You'll find code examples in C, Go, and Python.

Genres: Programming, Technology, Computer Science

Paperback

Reviews

[Simone · Rating 3 out of 5]

A fair introduction to eBPF.

It is however more focused on BCC rather than plain C eBPF programs and it doesn't cover what you need to know to develop and compile those. BTF it is not really covered, only referred to as debug information, not a single mention to the fact that it enables CORE and how, that is basically the future of BPF. A few inaccuracies here and there. The only detailed section is the one about XDP.

[David · Rating 4 out of 5]

Good info but lots of typos in first edition.

[Joshua Reuben · Rating 4 out of 5]

A tough read. This is a complicated tech stack with a high barrier of entry in a nieche area. The book gives a solid overview of the programming model and the use cases.