Netflix has introduced a new utility called BPFTOP designed to provide an interface for monitoring EBPF programs in the Linux kernel, similar to the popular TOP utility. This tool displays performance indicators, CPU load, and event processing for each EBPF program. Additionally, BPFTOP supports graph construction to evaluate the performance characteristics over time. The code for BPFTOP is written in Rust and is available under the Apache 2.0 license.
The main features of BPFTOP include:
- Displaying the list of active EBPF programs along with their identifiers, type, and name.
- Showcasing the period and average execution time of each EBPF program.
- Calculating CPU load and processed events per second for each EBPF program.
- Generating graphs for execution time, events per second, and CPU load in 10-second intervals.
- Real-time updating of the program list.
One of the primary goals behind the development of BPFTOP is to simplify the optimization of EBPF programs and enable dynamic monitoring of the effectiveness of any changes made to these programs. To gather statistics, BPFTOP leverages the BPF_ENABLE_STATS system call and collects information every second. This approach helps minimize overhead costs by gathering statistics only when the utility is active.
