Logs Collection With eBPF: Like a Super-Powered Postal Service - Aviv Zohari, groundcover
Channel: CNCF [Cloud Native Computing Foundation]
Date: 2024-03-27

Don't miss out! Join us at our next Flagship Conference: KubeCon + CloudNativeCon North America in Salt Lake City from November 12 - 15, 2024. Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at https://kubecon.io

Logs Collection With eBPF: Like a Super-Powered Postal Service - Aviv Zohari, groundcover

Logs collection in Kubernetes can be compared to a VIP postal service. Containers speak their logs out loud so that the container runtime can arrange them into envelopes, to be distributed via the K8s API. This method comes with a surprising amount of overhead, as one could imagine the work needed to write, sign and seal the letters, just to tear them open on demand.

eBPF has been transforming network visibility, and recent advances in its ability to handle large volumes of data will allow doing the same for logs - the noisiest observability pillar. By giving granular vision into containers directly from the kernel, it allows for a new, efficient and context-rich approach. Instead of envelopes, eBPF effectively allows us to hear the words directly, extracting them with minimal effort.

This talk will explore the limitations of existing open source solutions, demonstrating how eBPF tools could become a next-gen postal service - one courier to deliver all of your observability needs.