Open Source Summit + Embedded Linux Conference Europe 2020

BPF is a virtual machine inside the Linux kernel that allows to load user defined programs that are attached to different kernel hooks (kprobes, tracepoints, uprobes, etc). One BPF’s application is to perform tracing at the kernel level as BPF programs can capture information about different kernel events. BCC (BPF Compiler Collection) is a set of libraries for different languages such as Python, C++, Lua and many ready-to-use tracing tools.  This talk will give a quick introduction of BPF. It’ll present an introduction to the BCC project and its features. A demo of the more popular BCC tools will be done. It’ll also show how to create (or customize) your own tools. Finally, it’ll show how BCC is integrated with other projects to perform tracing in cloud environments like Kubernetes.