Universal Profiling with eBPF: Capturing Application Behavior Without Modifying Source Code

Universal profiling with eBPF is a practical guide to observing how applications behave in production, without changing source code or interrupting service. Built around modern tracing techniques, it explains how to collect meaningful signals from the kernel and user space, then turn them into clear answers about CPU time, latency, I/O, contention, and runtime behavior.

The book starts with the core ideas behind eBPF, including tracepoints, kprobes, uprobes, maps, and ring buffers, so readers can understand where data comes from and how it moves through a profiling pipeline. It then moves into safe setup, feature checks, permissions, and repeatable tracing practices, helping teams avoid fragile setups and noisy results.

Inside you will find coverage of:

Event schema design, timestamps, process and thread attribution, and handling high-volume streams CPU sampling, stack-aware profiling, histogram-based latency analysis, and hotspot aggregation I/O and network tracing, including file activity, block operations, queueing, and completion timing Scheduling, lock wait time, run queue behavior, thread pool backlogs, and other contention signals Profiling approaches for multiple languages and runtimes, including process discovery, GC, allocations, JIT activity, and normalized reporting User-space processing, symbol enrichment, query and filtering pipelines, export formats, and reproducible runs Operational concerns such as overhead, event loss, map sizing, security, and runbooks for troubleshooting The later chapters focus on end-to-end workflows, showing how to connect signals into a coherent investigation. Whether the problem is a latency spike, a throughput drop, a hot function, or an overloaded thread pool, the book shows how to collect evidence, reduce it into actionable views, and present findings in a form that engineers and operators can use immediately.

This is a hands-on resource for performance engineers, platform teams, SREs, and developers who need reliable observability with minimal perturbation. It combines foundation, implementation, and operational guidance into one clear path for building practical profilers with eBPF.