Kernel Tracing Using eBPF

Recorded August 2, 2023

View an interactive, complimentary Mentorship Session exploring Kernel Tracing Using eBPF with Vandana Salve, Independent Linux Kernel Consultant

eBPF is the kernel technology for a new generation of networking, observability and security tools. In this presentation we will primarily focus on using eBPF to dynamically instrument kernel functionality and gain deep insight on the workings of the kernel code. Starting with an introduction to eBPF concepts, programs, maps and verification, deep dive using eBPF to trace kernel functions and the data that flows through them.

This will give attendees hands-on experience and gain practical knowledge for using eBPF to monitor every action taken on a running system and know what is happening inside the kernel. The main advantage of using eBPF for tracing is that you can access almost any piece of information from the Linux kernel and your applications.