Uprobes has—I believe—DTrace USDT-like functionality. This seems interesting and different: sending the tracing facility into the traced/victim process. Whereas DTrace and ePBF typically trap into the kernel to execute and event, this approach allows for potentially much less overhead.
How important is enabled probe effect? Of that I’m less sure.
Comments
Uprobes has—I believe—DTrace USDT-like functionality. This seems interesting and different: sending the tracing facility into the traced/victim process. Whereas DTrace and ePBF typically trap into the kernel to execute and event, this approach allows for potentially much less overhead.
How important is enabled probe effect? Of that I’m less sure.
Oh, thanks, yes, that does sound interesting. I gave it too cursory a look earlier, ay!