BPF Performance Tools
by Brendan Gregg · first published 2019
25mentions
15recommended by
21HN commenters
2019–2025first – last mentioned
71% recommend29% neutral
Why HN recommends it
Good introduction to eBPF and bpftrace for performance work, showing what is possible and giving context to get started; suits engineers who want to trace kernel bottlenecks and profile programs on Linux.
Summarised by Claude from recommending comments
Affiliate links. As an Amazon Associate I earn from qualifying purchases.
Mentions per year
What Hacker News says
Related books
2018–2025Linux Kernel Programming
Kaiwan N Billimoria
Recommended by 4 · mentioned by 54 recommend · 5 mention4 recommend · 54 recommend
2014–2026Systems Performance
Brendan Gregg
Recommended by 32 · mentioned by 4632 recommend · 46 mention32 recommend · 4632 recommend
Linux Programming InterfaceMichael Kerrisk2011–2026
Linux Programming Interface
Michael Kerrisk
Recommended by 98 · mentioned by 12698 recommend · 126 mention98 recommend · 12698 recommend
…useful. If you'd like to do something more specialized, you could build something with a couple of lines in `bpftrace`, but you'll have to put in more work there if you're not familiar with it. The book "BPF Performance Tools" by Brendan Gregg is a good introduction there. Of course, for a simple overview, that would be way overkill, though :)
on “Why do we use the Linux kernel's TCP stack? (2016)” ↗…https://tldp.org/LDP/sag/html/index.html Performance & Benchmarking: Systems Performance: https://www.amazon.com/Systems-Performance-Brendan-Gregg-dp-... (this is Brendan Gregg's book where you learn about the magic of dtrace) BPF Performance Tools: https://www.amazon.com/Performance-Tools-Addison-Wesley-Prof... (the newer Brendan Gregg book about BPF, stellar) The Art of Computer Systems Performance Analysis: https://www.cse.wustl.edu/~jain/books/perfbook.htm…
on “My £4 a month server can handle 4.2M requests a day” ↗There are a number of good resources at https://ebf.io, including a couple of links to books. I haven't read those books personally, but I would be surprised if "BPF Performance Tools" by Brendan Gregg isn't worthwhile.
on “Application Traffic with eBPF” ↗For Linux kernel dev, I found Linux Kernel Programming: A Comprehensive Guide to Kernel Internals to be a really helpful resource. For eBPF, the early chapters of Brendan Gregg’s BPF Performance Tools gave me the context I needed to get started. From there, what’s helped me most is a cycle of reading new material, building prototypes and exploring how an open source system solves similar problems.…
on “Ask HN: What cool skill or project interests you, but feels out of reach?” ↗If you like this post, I would recommend “BPF Performance Tools” and “Systems Performance: Enterprise and the Cloud” by Brenden Gregg. I have pulled out a few miracles using these tools (identifying kernel bottlenecks or profiling programs using ebpf) and it has…
on “Linux Performance Analysis (2015)” ↗Hello HN, I'm sharing a little open-source utility I wrote recently. I'm a huge fan of Brendan Gregg's "BPF Performance Tools" book. However, every time I SSH into a fresh server, most of the diagnostic tools aren't installed there and installing them can be really annoying. I decided to use Nix package manager and LLMs to…
on “Show HN: 60-Second Linux Analysis, Supercharged with Nix and LLMs” ↗Per Brendan Gregg's Gesamptkunstwerk, BPF Performance Tools, I feel like you should be able to measure instructions per cycle at the service level. Even in the cloud if exposed by Xen. And even at the resource utilization level for each container. http://www.brendangregg.com/bpf-performance-tools-book.html Of course, you can always just use cloudflare ;)
on “On Sharding” ↗Agreed. using bpf can eliminate some of the requirements for packet captures. Computing the metrics on the host, also eliminates the network traffic of exporting logs or pcaps to for instance splunk. [1] Brendan Gregg wrote a book that digs really deep into the bpf system. [2] I recommend you check it out if you need to do real work fast. [1]: https://docs.splunk.com/Documentation/StreamApp/7.2.
on “Brim: Open-source desktop app to analyze large pcaps through the lens of Zeek” ↗There are two excellent books by Brendan Gregg which can teach you about eBPF: 1: Systems Performance: Enterprise and the Cloud, 2nd Edition <https://brendangregg.com/systems-performance-2nd-edition-boo...> 2: BPF Performance Tools <https://brendangregg.com/bpf-performance-tools-book.html> Contrary to the title, I would actually recommend the first one more and only if you feel starved for more
on “DTrace-on-Windows” ↗BPF is indeed a pretty interesting technology. As the knowledge about it becomes more widespread, I anticipate that we will unlock some new capabilities both in terms of tracing. Brendan Gregg's book (https://www.brendangregg.com/bpf-performance-tools-book.html) serves as a good intro to this, although you probably only need to read a small chunk of it as a lot of it is reference-book-style materi
on “Notes on BPF and eBPF” ↗Brendan Gregg literally wrote the book on BPF: http://www.brendangregg.com/bpf-performance-tools-book.html He is an engineering god.
on “Linux Kernel Runtime Guard” ↗Also see the book 'BPF Performance Tools: Linux System and Application Observability', published by Brendan Gregg (2019). This book can help you get the most out of your systems and applications, helping you improve performance, reduce costs, and solve software issues. [1] [1]: http://www.brendangregg.com/bpf-performance-tools-book.html
on “Bpftrace 0.10.0 Release Notes” ↗You should also check out bpftrace which is a specific DSL to write both the kernel and userspace part in one language - rather than the mixed python/C approach people mostly took before that. And you can output things potentially as text or json for parsing. https://github.com/iovisor/bpftrace I would also strongly recommend Brendan Greggs book: http://www.brendangregg.com/bpf-performance-tools
on “My First Kernel Module: A Debugging Nightmare” ↗To add to this, for me personally the difficult part in automated test isn't the definition of expected output, but the retrieval of actual output in an automated way. Test frameworks can and will only focus on a limited set of interaction (Playwright for DOM, detox for mobile etc.). I think Brendan Gregg's books[0][1] are quite inspiring for an understanding of a system with its inner workings,
on “Ask HN: Could you recommend a good book about writing automated software tests?” ↗Systems Performance: Enterprise and the Cloud (2nd Edition) https://www.brendangregg.com/systems-performance-2nd-edition... and BPF Performance Tools https://www.brendangregg.com/bpf-performance-tools-book.html
on “Ask HN: What books should I read to improve as a software engineer?” ↗