Looks great. I remember using bpftrace at work to debug a nasty performance issue, I went down the rabbit hole only to find a certain syscall was being called much too often. We managed to trace it back inside the sourcecode to a sleep(1 second), which was some sort of manual io scheduling commited by the CTO when the startup was early stage. Removing those few lines and installing kyber fixed the issues!

Just tried this on the eBPF code I am working on. Works great! This one is going straight into the toolbox.

Even though eBPF is super fast, I have found triggering complex probes many times will have performance implications, which can not easily be tracked down to the instrumenting application. This will help with that a lot.

What use cases people use eBPF for these days?

I find this somewhat amusing given one of the primary use cases of eBPF is measuring performance

Nice! But I got it to freeze under higher load. Removing the load does not help.