eBPF: tracing syscalls without a kernel module
Attaching a verified program to a tracepoint, and why this beats strace under load.
Attaching a verified program to a tracepoint, and why this beats strace under load.
Switching off loss-based congestion control on a long-fat path, and the fq gotcha for UDP.
Two ring buffers, one syscall, and the mental model that finally made it click.
Why my OOM kills moved around after switching to the unified hierarchy, and the three knobs that matter.