Performance & resources
Measure where time and resources go: scheduling latency, hardware IRQs, sampling profiles, memory leaks, block-I/O patterns, and power.
runqlat
Measure scheduler run-queue latency — how long tasks wait runnable-but-not-running — by stitching together the sched tracepoints, and meet the technique that hot paths demand: aggregating a histogram in the kernel instead of emitting per-event.
hardirqs
Measure the time the kernel spends in hardware-interrupt handlers, per IRQ vector, by timing the irq tracepoints keyed by CPU and accumulating per-vector totals in a kernel map — and understand why hardirq time is hidden latency.
profile
Build a sampling CPU profiler with a perf_event program firing at a fixed frequency across all CPUs, capture kernel and user call stacks with bpf_get_stackid and StackTrace maps, and emit flame-graph-ready folded output.
memleak
Find allocations that are never freed by pairing malloc/calloc with free on libc, recording each outstanding allocation's call stack with bpf_get_stackid so the leak points back to the code that made it.
biopattern
Classify block-device I/O as sequential or random per device by tracking each device's sector position across the block_rq_issue tracepoint — the access pattern that determines whether storage thrives or thrashes.
Energy monitoring
Attribute power consumption to individual processes — the modern sustainability use of eBPF — by crediting each task its on-CPU time and multiplying its share by system power from RAPL, and why virtualization makes this hard.