12 eBPF-Powered CLI Utilities That Every Modern Linux Sysadmin Should Master
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
eBPF enables kernel-level observability without performance overhead or system restarts. This guide covers 12 essential eBPF CLI tools for Linux system administration: bpftrace for custom kernel debugging, execsnoop for catching short-lived processes, opensnoop for file access tracing, tcplife and tcpconnect/tcpaccept for network session monitoring, biotop and biolatency for disk I/O analysis, tcpretrans for network reliability issues, gethostlatency for DNS debugging, biosnoop for detailed block I/O inspection, and bpftool for managing loaded eBPF programs. Each tool addresses specific debugging scenarios like permission errors, latency spikes, and mysterious performance drops.
Table of contents
Know this before trying eBPF1. bpftrace: The ultimate custom debugger2. execsnoop: Catching fleeting processes3. opensnoop: Permission denied demystified4. tcplife: Tracing microservice sessions5. gethostlatency: Fixing intermittent slowness6. biotop: Disk I/O task manager7. biolatency: The I/O performance historian8. tcpretrans: Spotting network reliability issues9. tcpconnect: Tracing outbound connections10. tcpaccept: Tracing inbound connections11. biosnoop: I/O operations in detail12. bpftool: Inspect and debug eBPF programs already runningWrapping UpSort: