# Linux Observability with BPF

DevFeed: [Linux Observability with BPF](<https://devfeed.tech/articles/linux-observability-with-bpf-35178.md>)

Original publisher: [Read original article](<https://blog.jessfraz.com/post/linux-observability-with-bpf/>)

Published: 2019-07-10T15:25:24Z

Content type: opinion

Language: en

Sources: [Jessie Frazelle](<https://devfeed.tech/sources/jessie-frazelle.md>)

Topics: [Linux](<https://devfeed.tech/topics/linux.md>), [observability](<https://devfeed.tech/topics/observability.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [Cilium](<https://devfeed.tech/topics/cilium.md>), [networking](<https://devfeed.tech/topics/networking.md>)

Tags: [bug](<https://devfeed.tech/tags/bug.md>), [centos](<https://devfeed.tech/tags/centos.md>), [cilium](<https://devfeed.tech/tags/cilium.md>), [docker](<https://devfeed.tech/tags/docker.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [linux](<https://devfeed.tech/tags/linux.md>), [networking](<https://devfeed.tech/tags/networking.md>), [observability](<https://devfeed.tech/tags/observability.md>)

## AI overview

A foreword for the book Linux Observability with BPF explains the author's interest in BPF and XDP, including their use for Linux kernel tracing, container networking, and replacing some iptables-based functionality. It also discusses Docker's iptables-related challenges and mentions Cilium, Cloudflare, and Facebook use cases.

## Source excerpt

Below is the foreward for the new book on Linux Observability with BPF by two of my favorite programmers, David Calavera and Lorenzo Fontana! I was pretty stoked about getting to write the foreward, I asked O'Reilly if I could publish it on my blog as well and they said yes. I hope you all check out this book and share what you've built after! As a programmer (and a self confessed dweeb) I like to stay up to date on the latest additions to various kernels and research in computing. When I first played around with Berkeley Packet Filters (BPF) and Express Data Path (XDP) in Linux I was in love. This is such a NICE THING and I am glad this book is putting BPF and XDP on the center stage so more people can start using it in their projects. Let me go into detail about my background and why I fell in love with these kernel interfaces... I worked as a Docker core maintainer, along with David (one of the brilliant authors of this book). Docker, if you are not familiar, shells out to iptables for a lot of the filtering and routing logic for containers. The first patch I ever made to Docker was fixing a problem where a version of iptables on CentOS didn't have the same command-line flags so writing to iptables was failing. There were a lot of weird issues like this and anyone who has ever shelled out to a tool in their software can likely commiserate. Not only that, having thousands of rules on a host is not what iptables was built for and has performance side effects because of it. Then I heard about BPF and XDP. This was like music to my ears. No longer would my scars from iptables bleed with another bug! The kernel community is even working on replacing iptables with BPF! Halleluyah! Cilium, container networking, is using BPF and XDP for the internals of their project as well. But that's not all! BPF can do so much more than just fulfilling the iptables use case. With BPF, you can trace any syscall or kernel function as well as any user-space program. bpftrace gives users d