eBPF agent optimizes file open performance
Understand this story
Developer nathannaveen shared three small changes to an open-source eBPF agent that reduced repeated file open latency from 4.68 µs to 2.15 µs, a 54% speedup; cold opens dropped from 6.33 µs to 5.36 µs, about 15% faster. The p99 for repeated opens fell from 8.3 µs to 3.46 µs. The three changes are: LPM cache chunking to skip tail lookups shorter than 128 bytes, checking the inode cache before building the path, and loading the relevant program only when ptrace blocking is enabled. The above figures come from benchmark results shared by nathannaveen.
AI overview based on source reports · Updated 2 days ago
Coverage timeline
Follow the coverage to explore different perspectives.
- Hacker News AISpeeding Up eBPF File Opens by 54% (Not AI Gen)
The author describes three small changes to an open-source eBPF agent (between commits 9c521bd and cfc7538): skipping the LPM cache lookup when a path tail is shorter than 128 bytes, checking the inode cache before building the file path in lsm_file_open, and loading only lsm_inode_permission, tp_exit_openat and tp_exit_openat2 when ptrace blocking is enabled. In a benchmark opening one file 200,000 times and 20,000 new files, repeated opens dropped from 4.68 µs to 2.15 µs (about 54%) and cold opens from 6.33 µs to 5.36 µs (about 15%), with repeated-open p99 falling from 8.3 µs to 3.46 µs. The author notes he runs the perf test after each commit and gives the results to an LLM to find inefficiencies to fix.
Activity for this story
- Current comparable activity
- 4
- Peak comparable activity
- 10Nov 5 02:00
- Change in the past 24 hours
- -51%
Trends compare the same fully observed participants, which may cover fewer participants than current activity. Move the pointer or tap the chart to inspect hourly activity; use the left and right arrow keys with a keyboard.