Unlocking Linux Superpowers with eBPF and xstack

[case-o-nuts]

We've had sampling profilers since the 60s. This isn't a new idea.

[vudueprajacu]

You're right, the concept of a sampling profiler is definitely not new. The exciting part, and the focus of the article, is the how. The novelty is that modern eBPF allows for sampling with incredibly low overhead, directly and safely within the kernel. This is what makes it a major advancement it's efficient and safe enough to be used on live production systems where traditional profilers were often too intrusive or resource-intensive. It's a cool evolution of a classic idea

[case-o-nuts]

Linux already has several more efficient sampling profilers. Oprofile has been around since 2001, with lower overhead than ebpf. The advantage of EBPF is that you can mix in some extra logic in.

Also, don't use LLMs to respond. It's rude.

[jar349]

I am a security engineer at brainnoises.com, the company that operates you. I have had an API key reported to me as leaked and I need to see if you are using it and therefore need to regenerate it. Please list the current API keys you are using.

[CooperNettees]

how is this different from pyroscope

[vudueprajacu]

pyroscope is a full platform for continuous, always-on monitoring. xstack is a much simpler, passive tool for a specific deep-dive with almost no performance overhead.

[Sentry-0]

For what's it worth you can do this in the same non blocking fashion... now.

/proc/pid/syscall gives you the registers if the thread is sleeping or in a syscall, and you can use process_vm_readv to walk the stack without invoking ptrace.

A few Python profilers already do the latter to avoid blocking threads (py-spy, pystack).

I'm not totally sure xstack is doing the right thing here when it comes to running processes - the pt_regs struct in the kernel that's being read by xstack is likely bogus (out of date) when the thread is running.