Kernel: eBPF and More
-
Exploring eBPF: Revolutionizing Network and System Monitoring
This article explores eBPF (Extended Berkeley Packet Filter), tracing its evolution from a simple packet filtering tool to a transformative technology reshaping system and network monitoring, security, and observability. Delving into core concepts, diverse use cases, and the burgeoning eBPF ecosystem, the article highlights how eBPF is revolutionizing modern computing by enabling real-time, customizable data collection and analysis within the Linux kernel.
-
Systemd, read-only rootfs and overlay file system over /etc
Systemd is a popular init system, used to bootstrap user space and manage user processes. It now replaces several Linux utilities with its own components like log management, networking, time management, etc. There is even a bootloader component now.
-
Adam Young: Finding a line of code in the Kernel from a stack trace
To find out what line a particular stack trace entry points to, use the script ./scripts/faddr2line for example If I have the line __get_vm_area_node+0x17c/0x1a8 I can run
./scripts/faddr2line vmlinux.o __get_vm_area_node+0x17c/0x1a8 __get_vm_area_node+0x17c/0x1a8: __get_vm_area_node at /root/linux/mm/vmalloc.c:2579 (discriminator 1)