OUR EXPERT
Mihalis Tsoukalos is currently working on Time Series. You can reach him at: @mactsouk.
For our final delve into eBPF, we’re tackling applications, the kernel and Docker containers. At the end of the day, all Linux machines execute code for applications or services, and we want to be able to understand why our programs are running slowly or misbehaving. Although the issue is usually with the app itself, there are times when the Linux kernel is misconfigured or is running slowly due to system limitations (memory, hard disk, network and so on). Additionally, many apps are now executed as Docker containers. So, in this last tutorial of the eBPF series we’re here to get you started with observability at the app, kernel or container level. While reading, please bear in mind that everything you have learned so far about eBPF in this series can be used for application, kernel and container observability.
Observability strategy
When you need to perform application observability, there is no single tool or technique that is going to solve all your performance issues. The key, and the difficulty, to application observability is not knowing all the available tools but choosing the appropriate ones. This section presents a generic strategy for dealing with app observability. The proposed steps are:
1. Ensure you understand the way the desired application operates, whether it accepts network connections or not, and if it performs lots of file I/O, and so on. This is going to help you select the appropriate eBPF tools for the job.
Get a
