eBPF is gaining more and more attention for good reasons. eBPF turns Linux into a “programmable” kernel, improving its observability, networking, and security.

If you work closely with Linux systems, learning about eBPF is indispensable, and BPF Performance Tools is the best resource. This book is written by Brendan Gregg, one of the main contributors on this subject, and author of the excellent Systems Performance.

The first part is an introduction to eBFP to understand its history and how it works under the hood. The second part is by far the largest one. It contains one or several chapters for every topic—CPUs, memory, filesystems, disk I/Os, networking, security, languages, applications, containers, and hypervisors. Each chapter starts with a gentle introduction, before introducing the traditional Linux commands and the BPF tools that complement them.

As a software developer, I found the book easy to follow, even without a solid background in Linux programming. The explanations are concise, clear, and remarkably illustrated. The commands used in examples are well-chosen and the comments really help to understand their output.

This book was invaluable during my last performance issues. Running commands to debug issues is easy. Knowing which command to run and understanding which statistics to read is far more challenging. This book will help you too.