Tweak eBPF documentation and add performance data (#8261)
* Tweak eBPF documentation and add performance data * Fixes for Chris and Thiago * Update collectors/ebpf_process.plugin/README.md Co-Authored-By: Patti Short <35278231+shortpatti@users.noreply.github.com> Co-authored-by: Patti Short <35278231+shortpatti@users.noreply.github.com>
Joel Hans committed
Mar 3, 2020 at 11:52 UTC
666a0628011e1cb34174f2d1eac33cbb8f614b96
1 file changed
+20
-5
collectors/ebpf_process.plugin/README.md
+20
-5
@@ -1,17 +1,22 @@
1
# eBPF monitoring with Netdata
2
3
-This collector plugin uses eBPF to monitor system calls inside your operating system's kernel. For now, the main goal of
4
-this plugin is to monitor IO and process management on the host where it is running.
3
+This collector plugin uses eBPF (Extended Berkeley Packet Filter) to monitor system calls inside your operating system's
4
+kernel. For now, the main goal of this plugin is to monitor IO and process management on the host where it is running.
5
6
<figure>
7
<img src="https://user-images.githubusercontent.com/1153921/74746434-ad6a1e00-5222-11ea-858a-a7882617ae02.png" alt="An example of VFS charts, made possible by the eBPF collector plugin" />
8
<figcaption>An example of VFS charts, made possible by the eBPF collector plugin</figcaption>
9
</figure>
10
11
+With this eBPF collector, you can monitor sophisticated system-level metrics about your complex applications while
12
+maintaining Netdata's [high standards for performance](#performance).
13
+
14
## Enable the collector on Linux
15
13
-Currently, this `ebpf_process` collector only works on Linux systems. Because it adds overhead to the system running it,
14
-the collector is also disabled by default.
16
+eBPF is only available on Linux systems, which means this collector only works on Linux.
17
+
18
+The collector is currently in an _alpha_ stage, as we are still working on improving compatibility with more Linux
19
+distributions and versions, and to ensure the collector works as expected.
20
21
Follow the next few steps to ensure compatibility, prepare your system, install Netdata with eBPF compiled, and enable
22
the collector.
@@ -183,7 +188,7 @@ In this section we define variables applied to the whole collector and the other
188
189
#### load
190
186
-The collector has three different eBPF programs. These programs monitor the same functions inside the kernel, but they
191
+The collector has two different eBPF programs. These programs monitor the same functions inside the kernel, but they
192
monitor, process, and display different kinds of information.
193
194
By default, this plugin uses the `entry` mode. Changing this mode can create significant overhead on your operating
@@ -195,3 +200,13 @@ following values:
200
- `return`: In this mode, Netdata also monitors the calls to function. In the `entry` mode, Netdata only traces kernel
201
functions, but with `return`, Netdata also monitors the return of each function. This mode creates more charts, but
202
also creates an overhead of roughly 110 nanosections for each function call.
203
+
204
+## Performance
205
+
206
+Because eBPF monitoring is complex, we are evaluating the performance of this new collector in various real-world
207
+conditions, across various system loads, and when monitoring complex applications.
208
+
209
+Our [initial testing](https://github.com/netdata/netdata/issues/8195) shows the performance of the eBPF collector is
210
+nearly identical to our [apps.plugin collector](../apps.plugin/), despite collecting and displaying much more
211
+sophisticated metrics. You can now use the eBPF to gather deeper insights without affecting the performance of your
212
+complex applications at any load.