Original companion notes for Brendan Gregg, BPF Performance Tools: Linux System and Application Observability. Every chapter is rewritten in plain, easy language with a one-minute summary, diagrams, real examples, gotchas, FAQs, takeaways — and a BCC/bpftrace cheatsheet at the end of every lesson you can copy straight to a terminal.
What BPF is, why it changed observability, BCC and bpftrace at a glance, and the mental model for the whole book.
chapter 2BPF internals, the verifier, maps, probes (kprobes, uprobes, tracepoints, USDT), and stack walking.
chapter 3Methodologies, the USE method, workload characterization, drill-down, and the 60-second checklist.
chapter 4The BPF Compiler Collection — installing, the tool library, single-purpose vs multi-tool, and usage.
chapter 5The bpftrace language — probes, filters, actions, variables, maps, builtins, and one-liners.
chapter 6CPU tracing — run-queue latency, profiling, off-CPU, scheduler events, and flame graphs with BPF.
chapter 7Page faults, allocations, OOM, swapping, and leak hunting with BPF tools.
chapter 8VFS, file-system latency, the page cache, read/write tracing, and per-file analysis.
chapter 9Block I/O latency, biolatency/biosnoop, queueing, and tracing the block layer.
chapter 10TCP lifetimes, retransmits, connection tracing, and the network stack with BPF.
chapter 11Privilege tracing, exec/connection monitoring, and BPF for runtime security observability.
chapter 12Tracing compiled, JIT, and interpreted languages — symbols, stacks, and USDT probes.
chapter 13Application-level tracing — requests, threads, locks, USDT, and on/off-CPU analysis.
chapter 14Kernel internals tracing — wakeups, work queues, interrupts, and deep kernel analysis.
chapter 15Tracing across namespaces and cgroups, per-container attribution, and the host-vs-guest view.
chapter 16Tracing virtual machines — guest vs host, steal time, and the limits of BPF visibility.
chapter 17The wider ecosystem — bpftop, ply, Cilium, and other front-ends beyond BCC and bpftrace.
chapter 18Event flooding, dropped events, stack/symbol issues, overhead, and the common traps to avoid.