Hi,

I've been doing some Linux debugging since one year, and I've used  BCC to solve multiple issues (like writting a ddos detector : https://github.com/iovisor/bcc/blob/master/examples/tracing/dddos.py). I have made an article : http://www.linuxembedded.fr/2019/03/les-secrets-du-traceur-ebpf/ (to present BCC to french community).

But, because my job focuses mainly on embedded systems; I and my colleague "Romain Naour" ported BCC to the Buildroot project and tests were already successful for ARM64 (Raspberry PI 3) as described in this article : http://www.linuxembedded.fr/2019/05/bcc-integration-into-buildroot/.

BCC is such a great tool and I'd love to know what you think about running it on tiny devices.

Note : sorry if you have received this mail twice, I've just added the mailing list.

Regards. 

--

Jugurtha.

--

32 boulevard Vincent Gâche 44200 NANTES

Jugurtha BELKALEM Ingénieur Etude et Développement 1  jugurtha.belkalem@...   http://www.smile.eu

 Pour la planète, n'imprimez ce mail que si c'est nécessaire

                    

      

Have you looked at using libbpf and BPF CO-RE for such use cases? The difference is that you won't have any additional runtime dependencies (no Clang/LLVM, etc), which makes this more suitable for embedded applications. The main requirement for running BPF CO-RE programs would be to compile kernel with CONFIG_DEBUG_INFO_BTF=y for BTF type information. Check out also https://github.com/iovisor/bcc/pull/2755 that adds first BPF CO-RE converted tool to BCC. See few links below for more details.

[0] BPF CO-RE presentation from LSF/MM2019 conference: summary, slides.

[1] https://facebookmicrosites.github.io/bpf/blog/2020/02/19/bpf-portability-and-co-re.html

[2] https://facebookmicrosites.github.io/bpf/blog/2020/02/20/bcc-to-libbpf-howto-guide.html