🕵️ 65-ebpf-for-sysadmins Index

🔬 eBPF for System Administrators

eBPF (extended Berkeley Packet Filter) revolutionizes system observability, allowing safe, dynamic tracing and monitoring without kernel modifications or performance impact.

📖 Contents

• eBPF Intro for Shell Users
• bpftrace One-Liners
• bpftrace vs strace
• bpftrace Recipes

🎯 Learning Objectives

✅ Understand eBPF fundamentals and use cases ✅ Master bpftrace for system observability ✅ Replace traditional debugging tools with eBPF ✅ Build custom monitoring solutions ✅ Troubleshoot performance issues dynamically

🔍 Quick Reference

Tool	Purpose	Shell Integration
bpftrace	High-level eBPF scripting	bpftrace script.bt
bcc	Python eBPF tools	execsnoop, opensnoop
bpftrace one-liners	Quick investigations	bpftrace -e '...'
perf	Performance profiling	perf record, perf script
tcplife	TCP connection monitoring	tcplife

🚀 eBPF Learning Path

1. eBPF Intro for Shell Users - Foundation
2. bpftrace vs strace - Tool comparison
3. bpftrace One-Liners - Quick investigations
4. bpftrace Recipes - Advanced monitoring