Netflix Releases bpftop: An eBPF-Based Application Monitor

Extended Berkeley Packet Filter, eBPF to its friends, enables you to run sandboxed programs in a privileged context in the Linux kernel. Netflix and many other companies, such as Google, use it for network monitoring.

Now, Netflix has unveiled bpftop, a new open source command-line tool designed to enhance the performance optimization and monitoring of eBPF applications.

As the streaming giant continues integrating eBPF technology into its infrastructure, ensuring these applications operate efficiently has become a top priority. Bpftop enables you to balance the power of eBPF with the need to maintain optimal system performance.

Bpftop offers a dynamic, real-time analysis of eBPF programs. It presents average runtime, events per second, and estimated total CPU percentage measurements for each program It’s engineered to minimize overhead, activating performance statistics only during its operation. By facilitating an efficient benchmarking, refinement, and feedback loop, bpftop eliminates the complexity traditionally associated with optimizing eBPF applications.

One of bpftop’s standout features is it renders statistics in time series graphs. This provides a clear view of patterns and trends that could otherwise go unnoticed. This visual representation of data is helpful for identifying performance bottlenecks and optimizing eBPF application efficiency.

Under the hood, bpftop does this by leveraging the BPF_ENABLE_STATS syscall command to collect global eBPF runtime statistics. This syscall is disabled by default to reduce performance overhead.

The program then processes this data every second, offering eBPF performance insights in an easily digestible top-like tabular format or through detailed time series graphs over a 10-second moving window. To boost overall performance, its backend is built on Rust, utilizing the libbpf-rs and ratatui crates. Once you’re done with it, you can switch bpftop off, and it will automatically disable BPF_ENABLE_STATS.

Netflix has made bpftop available under the Apache 2 license, inviting contributions from the broader community to refine further and enhance the tool. Interested users and developers are encouraged to visit the project’s GitHub page to dive deeper into its capabilities and contribute to its evolution. You can either pull the code from its GitHub or download the latest release with the following command:

To run bpftop, you’ll need sudo privileges and a  Linux kernel version 5.8 or newer.

The binary is dynamically linked to libz and libelf, so these libraries must be present on the systems for it to run.

Steven J. Vaughan-Nichols, aka sjvn, has been writing about technology and the business of technology since CP/M-80 was the cutting-edge PC operating system, 300bps was a fast internet connection, WordStar was the state-of-the-art word processor, and we liked it.

Read more from Steven J. Vaughan-Nichols