RousselTMLEARNING
EN
FrançaisEnglishEspañol
Sign in

Observabilité · Courses

Observability with eBPF: from discovery to expertise

Course on eBPF applied to observability: core principles, bpftrace and bcc, zero-code instrumentation with Beyla, network flows with Cilium Hubble, continuous profiling with Parca, security and production.

8 chapters12 lessonsEN
At your pace, through practice.

By the end of this course you will be able to

  • Explain how eBPF works and its attach points
  • Troubleshoot a server with bpftrace and bcc
  • Get metrics and traces without code using Beyla
  • Observe Kubernetes networking with Hubble
  • Profile a host with eBPF and deploy these tools securely

🎯 Level : Advanced👥 Who it is for : SREs, systems and platform engineers who want to observe applications and the network without modifying code

LEARNING PATH

Course curriculum

0Course overview1 lesson
  1. Assessment quizQuiz · ⏱ 10 min
1eBPF principles1 lesson

Programs, hooks, maps and portability.

  1. eBPF explainedArticle · ⏱ 3 min
2Troubleshooting with bpftrace and bcc2 lessons

Everyday tools.

  1. Troubleshooting with bpftrace and bccArticle · ⏱ 5 min
  2. Lab: Troubleshoot a Linux server with bpftraceHands-on lab · ⏱ 40 min · Level 2/5
3Zero-code instrumentation2 lessons

Beyla and OpenTelemetry eBPF Instrumentation.

  1. Zero-code instrumentation with BeylaArticle · ⏱ 7 min
  2. Lab: RED metrics and traces without code using BeylaHands-on lab · ⏱ 45 min · Level 3/5
4Networking with Hubble3 lessons

Kubernetes network flows and policies.

  1. Observing the network with HubbleArticle · ⏱ 4 min
  2. Lab: Kubernetes network flows with Cilium and HubbleHands-on lab · ⏱ 50 min · Level 4/5
  3. Lab: Profile an entire host with ParcaHands-on lab · ⏱ 35 min · Level 3/5
5eBPF profiling1 lesson

Parca, Pyroscope and OpenTelemetry.

  1. Continuous profiling with eBPFArticle · ⏱ 4 min
6Production and security1 lesson

Privileges, requirements and limitations.

  1. eBPF in productionArticle · ⏱ 3 min
7Best practices1 lesson

Recommended practices for running the product in production.

  1. eBPF best practicesArticle · ⏱ 3 min

LEARN BY DOING

Use cases & applications

Cover an entire fleet in a day

RED metrics for every service without instrumentation.

Understand Kubernetes networking

Flows, DNS and NetworkPolicy drops.

Troubleshoot a server

Files, processes and disk latency in a single command.

Reduce CPU costs

Continuous profiling of every process.

Recommended prerequisites

Prometheus: From Discovery to ExpertiseKubernetes: From Discovery to Expertise

What next?

Grafana Pyroscope: from discovery to expertiseOpenTelemetry: From Discovery to ExpertiseGrafana Tempo: from discovery to expertise

Frequently asked questions

Do you need to modify applications to use eBPF?

No: eBPF programs attach to the kernel and to existing processes. That is the whole point of the approach.

Is eBPF safe?

The kernel verifier prevents a program from crashing the kernel, but eBPF agents are privileged: they must be treated as sensitive components.

Which kernel version do you need?

At least 5.8 for most modern tools, 5.15 or later recommended, with BTF enabled.

Does eBPF replace OpenTelemetry?

No, it complements it: eBPF covers the whole fleet effortlessly, while the OpenTelemetry SDKs provide business-level detail.