pyroscope icon indicating copy to clipboard operation
pyroscope copied to clipboard

Improve the eBPF integration

Open abeaumont opened this issue 3 years ago • 1 comments

Our current eBPF support can be improved in some areas, including:

  • It's built on top of (python) bcc tools, which is thus a dependency.
  • It periodically loads / unloads the the BPF program, which may cause some profiling precission loss.
  • No support for BTF / CO-RE.

Some of these improvements may require higher minimal Linux kernel versions, to there are also some trade-offs to consider.

abeaumont avatar Feb 22 '22 12:02 abeaumont

Tentative plan:

  • Get the python-less version of ebpfspy to run
  • Get ebpfspy to run without compiling ebpf program each time
  • Make ebpfspy work on old versions of Linux as well (without CO-RE) https://github.com/aquasecurity/btfhub

petethepig avatar Jul 25 '22 04:07 petethepig

Improved see blog post here

Rperry2174 avatar Sep 29 '22 14:09 Rperry2174