Introduction to low-level profiling and tracing

User space, Kernel, and hardware profiling and tracing with ptrace, perf, SystemTap, and BCC

Christian Heimes

CPython DevOps general Performance

See in schedule Download Slides

Python has built-in tracing and profiling facilities in form of callback hooks in the sys module. The settrace and setprofile callbacks have several drawbacks. They slow down the Python interpreter considerable and only allow tracing of Python code. Modern OS and CPUs come with a variety of APIs for efficient and low-level tracing down to system calls, Kernel space code, and hardware events. Some tools even create code that runs in Kernel space.

This talks is an introduction and comparison of various low and high level tools for profiling and tracing as well as visualization tools like flame graphs. It covers ptrace, perf, SystemTap, and BCC/eBPF. Ptrace based commands like strace are easy to use but slow. Perf allows lightweight profiling of hardware events and CPU instructions. SystemTap is a powerful toolkit plus DSL to instrument probe points inside the Kernel as well as static SystemTap/DTrace markers in libs and languages like Java, PHP, and Python. CPython comes with a set of instrumentations for SystemTap. BCC is a collection of tools that run as JIT optimized eBPF code in Kernel space.

The talk is an introduction to basic concepts of low-level tracing and profiling on Linux. The main goal is the show the potential of the tools.

Type: Talk (45 mins); Python level: Advanced; Domain level: Intermediate


Christian Heimes

Red Hat

Christian is a Python core developer and security engineer from Hamburg/Germany. He maintains Python's ssl and hashlib module, and contributes to improve security of CPython. In his day job he works at Red Hat's security engineering and identity management department on FreeIPA and Dogtag PKI.