The Ultimate Guide to eBPF Monitoring

┌─────────────────────────────────────────────────────┐
│                  User Space                         │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐│
│  │ BPF Program │  │   BPF Maps  │  │Control Apps ││
│  │   (C/Rust)  │  │  (Storage)  │  │ (Loaders)   ││
│  └──────┬──────┘  └──────┬──────┘  └──────┬──────┘│
│         │                 │                 │       │
├─────────┼─────────────────┼─────────────────┼───────┤
│         │    System Call Interface         │       │
├─────────▼─────────────────▼─────────────────▼───────┤
│                   Kernel Space                      │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐│
│  │BPF Verifier │  │ BPF Runtime │  │ BPF Helpers ││
│  └─────────────┘  └──────┬──────┘  └─────────────┘│
│                          │                          │
│  ┌───────────────────────▼──────────────────────┐  │
│  │         Kernel Subsystems & Hooks            │  │
│  │  Network  │  Tracing  │  Security  │  Perf   │  │
│  └──────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────┘

// Example: Simple packet counter
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __type(key, __u32);
    __type(value, __u64);
    __uint(max_entries, 1024);
} packet_count SEC(".maps");

SEC("xdp")
int count_packets(struct xdp_md *ctx) {
    __u32 key = 0;
    __u64 *count = bpf_map_lookup_elem(&packet_count, &key);
    
    if (count) {
        __sync_fetch_and_add(count, 1);
    }
    
    return XDP_PASS;
}

// CPU profiling with eBPF
SEC("perf_event")
int profile_cpu(struct bpf_perf_event_data *ctx) {
    u32 pid = bpf_get_current_pid_tgid() >> 32;
    u64 ts = bpf_ktime_get_ns();
    
    struct stack_trace_t *trace;
    trace = bpf_map_lookup_elem(&stack_traces, &pid);
    
    if (trace) {
        trace->kernel_stack_id = bpf_get_stackid(ctx, 
            &kernel_stacks, KERN_STACKID_FLAGS);
        trace->user_stack_id = bpf_get_stackid(ctx, 
            &user_stacks, USER_STACKID_FLAGS);
        trace->timestamp = ts;
    }
    
    return 0;
}

# Install dependencies on Ubuntu/Debian
sudo apt-get update
sudo apt-get install -y     clang llvm libelf-dev libbpf-dev     linux-headers-$(uname -r)     bpftool linux-tools-$(uname -r)

# Install BCC (BPF Compiler Collection)
sudo apt-get install -y bpfcc-tools linux-headers-$(uname -r)

# Install bpftrace
sudo apt-get install -y bpftrace

# Verify installation
bpftool version
bpftrace --version

// http_monitor.bpf.c
#include <vmlinux.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>

#define MAX_MSG_SIZE 256

struct event {
    u32 pid;
    u32 uid;
    u8 comm[16];
    u8 msg[MAX_MSG_SIZE];
};

struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 256 * 1024);
} events SEC(".maps");

SEC("uprobe/SSL_write")
int trace_ssl_write(struct pt_regs *ctx) {
    struct event *e;
    const char *buf = (const char *)PT_REGS_PARM2(ctx);
    
    e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
    if (!e)
        return 0;
    
    e->pid = bpf_get_current_pid_tgid() >> 32;
    e->uid = bpf_get_current_uid_gid() & 0xFFFFFFFF;
    bpf_get_current_comm(&e->comm, sizeof(e->comm));
    
    bpf_probe_read_user_str(&e->msg, sizeof(e->msg), buf);
    
    bpf_ringbuf_submit(e, 0);
    return 0;
}

char LICENSE[] SEC("license") = "GPL";

// loader.go
package main

import (
    "bytes"
    "encoding/binary"
    "fmt"
    "log"
    "os"
    "os/signal"
    
    "github.com/cilium/ebpf/link"
    "github.com/cilium/ebpf/perf"
    "github.com/cilium/ebpf/rlimit"
)

//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc clang -type event bpf http_monitor.bpf.c

func main() {
    // Remove memory limit for eBPF
    if err := rlimit.RemoveMemlock(); err != nil {
        log.Fatal(err)
    }

    // Load pre-compiled eBPF programs
    objs := bpfObjects{}
    if err := loadBpfObjects(&objs, nil); err != nil {
        log.Fatalf("loading objects: %v", err)
    }
    defer objs.Close()

    // Attach to SSL_write
    ex, err := link.OpenExecutable("/usr/lib/x86_64-linux-gnu/libssl.so.1.1")
    if err != nil {
        log.Fatal(err)
    }
    
    l, err := ex.Uprobe("SSL_write", objs.TraceSslWrite, nil)
    if err != nil {
        log.Fatal(err)
    }
    defer l.Close()

    // Read events from ring buffer
    rd, err := perf.NewReader(objs.Events, os.Getpagesize())
    if err != nil {
        log.Fatal(err)
    }
    defer rd.Close()

    // Handle Ctrl-C
    sig := make(chan os.Signal, 1)
    signal.Notify(sig, os.Interrupt)

    fmt.Println("Monitoring HTTPS requests... Press Ctrl-C to exit")
    
    go func() {
        <-sig
        os.Exit(0)
    }()

    // Process events
    var event bpfEvent
    for {
        record, err := rd.Read()
        if err != nil {
            log.Fatal(err)
        }

        if err := binary.Read(bytes.NewBuffer(record.RawSample), 
            binary.LittleEndian, &event); err != nil {
            continue
        }

        fmt.Printf("[%d] %s: %s
", event.Pid, 
            string(event.Comm[:]), string(event.Msg[:]))
    }
}

// Adaptive sampling based on load
#define SAMPLE_RATE 10  // Sample 1 in 10 events

SEC("kprobe/tcp_sendmsg")
int trace_tcp_send(struct pt_regs *ctx) {
    // Simple sampling
    if (bpf_get_prandom_u32() % SAMPLE_RATE != 0)
        return 0;
    
    // Or time-based sampling
    u64 now = bpf_ktime_get_ns();
    static u64 last_sample = 0;
    
    if (now - last_sample < 1000000)  // 1ms minimum
        return 0;
    
    last_sample = now;
    // ... rest of monitoring logic
}

eBPF in Production