Linux Monitoring at Scale with eBPF

Explore advanced Linux monitoring techniques using eBPF in this 29-minute conference talk from BSidesSF 2017. Delve into the implementation of Berkeley Packet Filter (BPF) virtual machine in recent Linux kernels, enabling safe and efficient syscall hooking. Learn about lightweight alerting strategies for large-scale environments, focusing on process execution, network connections, and file integrity monitoring. Discover how to achieve meaningful security monitoring with less than 1% overhead, balancing comprehensive fleet-wide alerting with targeted, in-depth scrutiny of specific subsets. Gain insights from experts Brendan Gregg and Alex Maestretti on leveraging eBPF for efficient, scalable Linux monitoring in security-critical environments.