|
|
|
|
|
by josefbacik
3595 days ago
|
|
Systemtap was fantastic, but super finnicky. You had to have debuginfo for the kernel installed plus the source. This was fine for RHEL but kind of a pain elsewhere. Then you run into other problems like sometimes the distro compiler wasn't used to build the kernel you are running and suddenly you couldn't load any stap script. Also the only way to get output was through stdout, there was no easy way to programmatically pull results from an stap script. BPF/BCC solves most of this. You still have to have the sources so you can get the right targets for kprobes, but you don't have the compiler mismatch problem. You can now access the hash maps directly from user space so you can do things like build system monitoring tools that run in production and record really specific information easily. I used systemtap for years, but bcc/bpf is a whole new world. |
|