master · Module 3.1
eBPF for Zero-Instrumentation Observability
Learning Objectives
- Explain how eBPF programs attach to kernel hooks to observe syscalls and network events.
- Describe zero-code instrumentation for capturing L4/L7 traffic on an OTT node.
- Understand the safety model (verifier) and overhead trade-offs.
Key Concepts
eBPF programs and hooks
eBPF runs sandboxed programs in the kernel attached to hooks (kprobes, tracepoints, XDP). They can observe syscalls, TCP events, and HTTP without modifying application code.
Zero-instrumentation telemetry
Tools like Pixie/Cilium use eBPF to auto-capture golden signals and even L7 protocol data for services you never manually instrumented — valuable for legacy OTT components.
Verifier and overhead
The kernel verifier rejects unsafe eBPF programs (no unbounded loops, bounded memory), giving strong safety guarantees at low, predictable overhead.
Info
eBPF sees the wire, so it captures traffic even for services with no OTel SDK — but it cannot see application-level business context the way manual spans can.
Warning
eBPF observability is powerful but kernel-version sensitive; test programs against your node kernels before fleet rollout.
Knowledge Check
1. What is the main observability advantage of eBPF?
2. What role does the kernel verifier play for eBPF programs?
3. What can manual OTel spans capture that eBPF generally cannot?