Throughput and latency measure different things, and most of the systems pain we feel at scale comes from pretending they don’t. Here is how they actually trade off, with real production patterns.
How modern span processors decide what to keep, what to drop, and how to bucket latency without lying to you. We unpack tail-sampling evaluators and adaptive bucket strategies used in OpenTelemetry Collector pipelines.
How to design and ship eBPF-based telemetry pipelines on constrained embedded Linux devices — covering CO-RE, ring buffers, perf events, and the patterns that survive contact with 32 MB RAM and flaky flash.
TL;DR — eBPF lets you load and run sandboxed bytecode inside the Linux kernel at near-native speed, attached to hooks like network events, syscalls, and tracepoints. A static verifier guarantees the program terminates and stays safe before a JIT compiler turns it into machine code, which is why tools like Cilium, Pixie, and bpftrace have reshaped observability and networking in production. If you’ve shipped a service on Linux in the last five years, you’ve almost certainly been touched by eBPF — even if you never wrote a program yourself. Cilium powers the networking and service mesh layer for hyperscalers like AWS and Shopify. Datadog and New Relic ship kernel probes for zero-instrumentation tracing. Cloudflare uses eBPF to do connection tracking and DDoS mitigation at line rate. The reason this is possible is a piece of kernel machinery that turns “the kernel is a closed black box” into “the kernel is a programmable, observable, auditable system,” without compromising its stability. ...
Learn how to apply the USE method to systematically diagnose performance bottlenecks in production systems by checking utilization, saturation, and errors for every resource.