Compare with ebpf

[GammaPi]

UProbe specifically

[GammaPi]

Claims about ebpftrace is faster: https://news.ycombinator.com/item?id=28121106

[GammaPi]

https://stackoverflow.com/questions/73817640/does-uprobe-add-a-significant-overhead-for-tracing

[GammaPi]

How to use uprobe https://www.brendangregg.com/blog/2015-06-28/linux-ftrace-uprobe.html

[GammaPi]

A profiler built with bpf that works like perf https://github.com/pixie-io/pixie-demos/tree/main/ebpf-profiler

[GammaPi]

bpftrace can handle counting directly. But it only supports a limited amount of trace points.

[GammaPi]

Ltrace implemented with ebpf: https://github.com/jvns/ltrace-bcc This can act as a template for our usage.

[GammaPi]

BCC tools broken on 18.04 when kernel version > 5.4 https://gitlab.com/gitlab-com/gl-infra/reliability/-/issues/12052

On 4.x the previous code reports error:

root@masslabserv1:/media/umass/datasystem/steven/ltrace-bcc/target/debug# ./ltrace-bcc 7592 /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
failed to attach uprobe: _ITM_deregisterTMCloneTable
failed to attach uprobe: g_signal_accumulator_true_handled
failed to attach uprobe: g_object_unref
failed to attach uprobe: g_str_hash
failed to attach uprobe: g_cclosure_marshal_generic
failed to attach uprobe: __cxa_finalize
failed to attach uprobe: g_str_equal
failed to attach uprobe: g_free
failed to attach uprobe: __gmon_start__
failed to attach uprobe: _ITM_registerTMCloneTable
Starting to trace
^C

[GammaPi]

bpftrace does not support API tracing https://github.com/iovisor/bpftrace/issues/556

[GammaPi]

Ebpf has high overhead. Besides, there is limitation on how many probes to install.