Linux Observability with BPF code examples

This is the companion code repo for the book Linux Observability with BPF.

We believe that even if the examples included in the book were all tested and working when we wrote them, human error is possible and technology changes. For that reason, the purpose of this repo is to keep them as updated as possible and correct mistakes we made while writing the book.

Nota Bene: All the examples in this repository are adapted from the book to assume that you use the Vagrant environment we provide. Examples can be slightly different in this repository because of that. The reason is that we didn't want to couple the book itself to Vagrant as a tool. If you don't want a Vagrant based environment, make sure you have: bcc and clang

Vagrant Environment setup

We provide reproducible environment in the form of a Vagrantfile that installs all the needed to make the exampples work. tools.

Install Vagrant

To install Vagrant, follow the official guide here.

Once you have Vagrant installed, you will need to clone this repository and issue a vagrant up.

git clone https://github.com/bpftools/linux-observability-with-bpf.git
cd linux-observability-with-bpf
vagrant up

This Vagrant command, will start a Fedora 30 VM in Virtualbox, you can SSH into the machine using:

vagrant ssh

Before going on, make sure you download the kernel source tree in this repository. It is needed as a dependency for some examples. We will be downloading the code for Kernel 5.0.9 - We are avoiding a git clone here because the Git history of the kernel is very big.

In the machine:

cd /tmp
wget -c https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.0.9.tar.gz -O - | tar -xz
sudo mv linux-5.0.9 /kernel-src

At this point, we need to compile the libbpf library:

cd /kernel-src/tools/lib/bpf
make

Now that you are in the machine and have everything, you can cd into the /vagrant folder, you'll find this repository in that folder since it's one-time synced between the VM and your Computer.