Brendan Gregg's performance diagrams are the field's most-shared cheat sheets — dozens of tools pinned to a map of the system. This series turns each diagram into a detailed chapter: every box explained, every tool given a purpose, in plain language with copy-paste commands. The arc follows real performance work — find the bottleneck (observe), check the config (static), measure the ceiling (benchmark), turn the knobs (tune), remember the past (sar) — then go deep on tracing itself: ftrace perf-tools, BCC, bpftrace, and the full BPF Performance Tools catalogue. All nine maps, complete.
The famous observability diagram walked layer by layer: apps & syscalls, the file/VFS stack, the full network stack, CPU & scheduler, virtual memory, the block/disk path, hardware counters — plus the USE method and a 60-second triage sweep.
Inspect configuration at rest, no load needed. Wrong RAID mode, a NIC negotiated down, half-populated memory, a powersave governor — none look 'busy' yet each caps you. Every config inspector from ldd to dmidecode to lscpu.
A load generator per layer — fio, iperf, sysbench, lmbench, wrk, MLPerf. What each stresses, the right way to run it, the three traps that turn benchmarks into lies, and why you always pair a benchmark with observability.
Now change things. A knob per layer — nice/taskset/numactl, ionice/blockdev, sysctl/tc/ethtool, tune2fs, ulimit, stap/kpatch. What each changes, the safe way to apply it, and the iron rule: one change, measure, keep or revert.
Historical observability: sar records counters to disk so you can troubleshoot a 3am slowdown at 9am. One tool, every subsystem by flag — CPU, memory, disk, network — live or replayed from history with -f. Plus collection and sadf export.
Before eBPF: powerful tracing using only built-in ftrace and perf_events — no compiler, no packages. The survival kit for old/locked-down kernels. execsnoop, iosnoop, tcpretrans, and the ftrace power-trio funccount/funcgraph/kprobe.
Dozens of ready-made eBPF tools organised by subsystem: filesystem, per-FS latency, block I/O, language runtimes (ugc, mysqld_qslower), syscalls, CPU & scheduler, memory, the deep TCP stack, and the multi-tool builders.
Write your own eBPF tracing in one line. The whole language — probes, filters, actions, built-ins, and @ maps + hist() for cheap in-kernel aggregation — plus the shipped .bt tools. Read and write bpftrace, not just run it.
~150 tools from Gregg's book, proving eBPF reaches every corner — file internals, SCSI/NVMe latency, per-socket ops, typed page faults, hypervisor exits. The new depth plus the methodology that ties all nine chapters together.