This 2-hour technical course covers Linux system monitoring using bpftrace, a command-line utility that uses extended Berkeley Packet Filters (eBPF) to capture kernel events. Includes an introductory tutorial, followed by hands-on practice tracing system calls, debugging and navigating architectural differences (x86_64 vs. ARM64).

***************** Prerequisites:*****************************
Please have Docker installed on your laptop so you can get started right away.

*************************************************************

Learning Objectives:
By the end of this session, you will be able to:

Build Custom System Call Traces in bpftrace: Understand how to identify the available tracepoints, capture them, extract data from the data structures used by the syscalls themselves, and write them to log files.
Troubleshoot Tracing Failures: Diagnose common errors such as “No matches for tracepoint” by understanding how system calls are mapped and implemented at the kernel level.
Navigate Container Observability: Identify the limitations of eBPF in containerized environments. Learn to distinguish between native runtimes (like runc) where host-level tracing is effective, and isolated environments (like MicroVMs or Userspace Sandboxes) that are opaque to eBPF.
Follow Best Practices and Evolve your Understanding: a survey of ways to evolve from bpftrace to custom eBPF programming and higher-level frameworks (such as Falco’s libscap/libsinsp).