For a beginner, tracing infrastructure in Linux can be considerably confusing. It's easier to get lost while trying to figure out what exactly are tracing mechanisms, which ones should be used. Addition of new eBPF support for tracing has added more to it. This is just an attempt to compile what is my current understanding, with a slightly more bias towards what facilities eBPF provides, as this is the state of the art.

Continue reading