eBPF is a powerful technology, but how could it be used in critical scenarios with throughputs higher than billions events per second? If this question doesn't make you sleep at night, this is the right talk for you. Building a large scale tracing tool is hard... Falco uses BPF to trace syscalls, page-faults, context-switches, and many other system events; but collecting all of those inevitably leads to data losses. The situation becomes even more complex when we consider the portability issue: supporting lots kernel versions, even very old ones, means not being able to take advantages of all modern BPF concepts like ring-buffer, global variables, and other advanced tracing features. Starting from these assumptions, Andrea and Federico will drive you through the actual BPF probe architecture, its strengths, and the criticalities that must be faced every day. More precisely, they will outline some possible mitigations to actual problems and what they are planning for the future to improve the situation, exploiting, when possible, modern BPF tracing features.
Click here to view captioning/translation in the MeetingPlay platform!
