This repository contains the code, scripts, and experimental results supporting the article "No Two Snowflakes Are Alike: Studying eBPF Libraries’ Performance, Fidelity and Resource Usage", accepted at the 3rd Workshop on eBPF and Kernel Extensions (eBPF ’25).
The main goal of the article is to highlight the importance of considering efficiency metrics, including performance, resource usage, and data collection fidelity, when choosing among the many well established and emerging eBPF libraries. This decision poses a challenge for developers due to the large number of available options. We address this by experimentally comparing five popular libraries: bpftrace, BCC, libbpf, ebpf-go, and Aya. For each library, we implement three representative eBPF-based tools and evaluate their performance under different storage I/O workloads.
Please cite the article as follows:
Carlos Machado, Bruno Gião, Sebastião Amaro, Miguel Matos, João Paulo, and Tânia Esteves. 2025. No Two Snowflakes Are Alike: Studying eBPF Libraries’ Performance, Fidelity and Resource Usage. In 3rd Workshop on eBPF and Kernel Extensions (eBPF ’25), September 8–11, 2025, Coimbra, Portugal. https://doi.org/10.1145/3748355.3748364
The project compares five eBPF libraries across three tools and three I/O workloads using the FIO benchmark:
- Libraries: bpftrace, BCC, libbpf, ebpf-go and Aya
- Tools: syscount, rw-tracer, rw-tracer-all
- Workloads: read-only, write-only, mixed (50/50)
The experiments measure:
- Performance: Latency and throughput of the tools, reported by the
FIObenchmark - Fidelity: Accuracy of the data collected by the tools (i.e., the number of events captured / events lost)
- Resource Usage: CPU and memory consumption, collected using
pcp-dstat - Energy Consumption: Power usage during the experiments, measured with
Intel RAPL
The project includes three eBPF-based tools with different characteristics.
| Tool | Purpose | Characteristics |
|---|---|---|
| syscount | Counts system call invocations | Lightweight; minimal kernel-to-user communication; instruments the raw_syscalls tracepoint. |
| rw-tracer | Traces read() and write() system calls at the VFS layer |
Captures per-call information such as timestamps, arguments (excluding buffers), and return values; ≈156 bytes per event. |
| rw-tracer-all | Traces read() and write() calls and captures part of the buffer |
Includes up to 4 KiB of I/O buffer data per event; generates large, high-volume event streams (≈4.2 KiB/event). |
All tools were implemented uniformly across libraries, with equivalent logic and configuration where possible.
Each tool was implemented using the five libraries and tested across 7 setups.
| Setup | Description | Polling Strategy | Synchronism |
|---|---|---|---|
| Vanilla | Baseline setup without any eBPF instrumentation. | — | — |
| bpftrace | Implemented using bpftrace scripts. | Implicit (not user-configurable) | Implicit |
| BCC | Implemented in Python (user space) with C (kernel) using BCC. | Library-provided (epoll-based) | Synchronous |
| libbpf | Implemented in C (both user space and kernel) using libbpf. | Library-provided (epoll-based) | Synchronous |
| ebpf-go | Implemented in Go (user space) and C (kernel) using ebpf-go. | Library-provided (epoll-based) | Synchronous |
| AyaSync | Implemented in Rust (both user space and kernel) using Aya. | Custom (active polling)* | Synchronous |
| AyaAsync | Implemented in Rust (both user space and kernel) using Aya with Tokio. | Library-provided (epoll-based via AsyncFd) |
Asynchronous (Tokio) |
* AyaSync uses a custom polling loop because the Aya library does not provide synchronous polling support out of the box. Only asynchronous polling is officially supported via AsyncFd and the Tokio runtime.
The Vanilla setup serves as the baseline, with no eBPF instrumentation, allowing to measure overhead, event fidelity, and resource usage introduced by each library.
The repository is organized as follows:
.
├── docs/ # Documentation files
├── gnu_plots_parser/ # Scripts to generate plots and reproduce paper figures
├── parser/ # Python scripts to process and analyze traces
├── README.md # Project documentation
├── scripts/ # Scripts to run and process experiments
├── src/ # eBPF tool implementationsSee install.md for dependencies, setup instructions, and how to run the tools and process the results.
Performance, fidelity, and resource usage results for all workloads (Read, Write, Mixed) are available in results.md.
This work is funded by national funds through FCT – Fundação para a Ciência e a Tecnologia, I.P., under the support UID/50014/2023 (https://doi.org/10.54499/UID/50014/2023), plurianual grant UIDB/50021/2020, and co-funded by the European Regional Development Fund (ERDF) through the NORTE 2030 Regional Programme under Portugal 2030, within the scope of the project BCDSM, reference 14436 (NORTE2030-FEDER-00584600).
For additional information regarding possible improvements and collaborations, please contact us at [email protected] or [email protected].