Traditional vs eBPF Instrumentation

Traditional vs eBPF Instrumentation An architecture diagram generated by Archify. Application Code · service source · Traditional Instrumentation Application Code service source Manual / auto SDK · per-language library · Traditional Instrumentation Manual / auto SDK per-language library Configure / restart · build · rollout · Traditional Instrumentation Configure / restart build · rollout Data Collection · instrumented parts only · Traditional Instrumentation Data Collection instrumented parts only Application Code · service source · eBPF Instrumentation Application Code service source No Changes · Less app code change · eBPF Instrumentation · no-code No Changes Less app code change no-code eBPF Program · safe in-kernel execution · eBPF Instrumentation eBPF Program safe in-kernel execution Kernel-level Hooks · Supported kernel/runtime · eBPF Instrumentation Kernel-level Hooks Supported kernel/runtime Data Collection · Supported protocols · eBPF Instrumentation Data Collection Supported protocols observed without code changes Traditional Instrumentation eBPF Instrumentation Legend Backend Database Cloud Security

Traditional instrumentation

  • • Auto-instrumentation may avoid source changes
  • • Capture application semantics and custom spans

eBPF instrumentation

  • • Kernel, runtime and TLS-library constraints
  • • Validate overhead, privileges and sensitive data