Netflix has recently announced bpftop, a command-line utility aimed at enhancing the optimization and monitoring of eBPF programs. bpftop provides a real-time snapshot of eBPF programs in operation. It shows metrics such as the average duration of program execution, the number of events processed every second, and an approximation of the total CPU usage percentage for each program. With this tool, Netflix is set to leverage the capabilities of eBPF.
Jose Fernandez, senior software engineer at Netflix, elaborated on the announcement in a blog post. bpftop uses the BPF_ENABLE_STATS command to start collecting important performance data from eBPF programs. This data collection is turned off to keep the computer running smoothly. bpftop gathers this data and calculates useful information. The data collected is shown in a table similar to the top command or as a graph that updates over a 10-second period. When bpftop stops running, it also stops the collection of statistics. This tool is created using the Rust programming language and makes use of the libbpf-rs and ratatui packages for its functionality.
Source: Announcing bpftop: Streamlining eBPF performance optimization
bpftop simplifies the process of enhancing the performance of eBPF programs by facilitating a loop of benchmarking, refining code, and obtaining instant feedback. Without bpftop, optimizing these programs would involve manual calculations. However, bpftop allows users to easily set a benchmark, make improvements, and confirm those improvements, making the entire process efficient.
An important feature of this tool is that it can show statistics as graphs over time, which helps to spot patterns and trends.
Originally, BPF was an acronym for Berkeley Packet Filter. However, according to ebpf.io, the capabilities of eBPF (extended BPF) have expanded beyond just packet filtering, leaving the original acronym outdated. Still, the term BPF is used in the Linux source code. In various tools and documentation, BPF and eBPF are often used interchangeably. Today, eBPF is used in various scenarios, including enhancing networking and load balancing in modern data centers and cloud environments, offering detailed security data with minimal overhead, and assisting developers in tracing applications, among others.
Fernandez pointed out that although Netflix has integrated eBPF into their performance engineering through tools like Vector and Flow Exporter sidecar, with bpftop, Netflix seeks to find a balance between the advantages of eBPF and the load it places on the system.
The tech community took notice of the bpftop announcement made by the Netflix Engineering account on X.com, with 223 reposts and 1.2k likes. The post on Hacker News received notable engagement from the technology community. A user bschuur shared their positive experience with the tool on their eBPF code project, highlighting its effectiveness. Consequently, the tool was recognized as sufficiently valuable to be considered a crucial addition to their toolkit.
For further information on utilizing the tool, readers are encouraged to visit the bpftop's GitHub page. The project has been made available under the Apache 2 license as an open-source project, and contributions from the community are welcomed.
