9 parts · 9 chapters

Systems Performance and eBPF

How to find out why a machine is slow instead of guessing: a method, the resources to check in order, and the tools that answer each question on a live Linux system. Built on Brendan Gregg's methods and the Kernel Internals course.

Nine parts: methodology (the USE method, workload characterisation, the 60-second checklist); CPU; memory; file systems; disks; network; perf and flame graphs; eBPF and bpftrace; and tuning with a change-one-thing discipline.

Start reading · Part 0 Present as slides
methodology (USE, workload characterisation) · CPU · memory · file systems · disks · network · perf and flame graphs · eBPF and bpftrace · tuningsenior → staff · backend, infrastructure and SRE engineers
methodUSE for every resource; RED for every service.
cpuUtilisation, saturation, run queues, profiling.
memoryWorking set, faults, swapping, reclaim.
storageFile system latency first, then the disk.
networkThroughput, retransmits, drops, queues.
toolsperf, flame graphs, bpftrace one-liners.
00

Methodology: USE, Workload Characterisation, the 60-Second Checklist

A method before tools
1 ch · ~8 min01

CPU

Utilisation, saturation, efficiency
1 ch · ~8 min02

Memory

Pressure, reclaim, faults
1 ch · ~8 min03

File Systems

Latency the application feels
1 ch · ~8 min04

Disks

Operations, latency, queues
1 ch · ~8 min05

Network

Throughput, loss, latency
1 ch · ~8 min06

perf and Flame Graphs

Profile, then optimise
1 ch · ~8 min07

eBPF and bpftrace

One-liners that answer real questions
1 ch · ~8 min08

Tuning

Settings with reasons
1 ch · ~8 min
Built on Kernel Internals and DiagnosisUses Kernel Internals for the paths being measured and Backend Diagnosis for the application-level counterpart.