XCapture v3: Linux Performance Analysis with Modern eBPF and DuckDB
Hello, I just released the (eventually) final version of my xcapture eBPF performance tool that now uses modern eBPF (libbpf, BTF, CO-RE, passive sampling using task iterators, task-local storage, etc). The previous BCC-based v2 version got a good discussion here last year [1], but due to BCC being less flexible and now deprecated, I decided to pull the plug and start from scratch with the latest eBPF features available. I'm targeting Linux kernels 5.14 and up. So Ubuntu 20 with HWE kernel (5.15) already works, RHEL9 works, Oracle's RHEL8 clone OEL8 with Oracle's UEK7 kernel (5.15) also…
What it does
In the maker’s words, at launch
Hello, I just released the (eventually) final version of my xcapture eBPF performance tool that now uses modern eBPF (libbpf, BTF, CO-RE, passive sampling using task iterators, task-local storage, etc). The previous BCC-based v2 version got a good discussion here last year [1], but due to BCC being less flexible and now deprecated, I decided to pull the plug and start from scratch with the latest eBPF features available. I'm targeting Linux kernels 5.14 and up. So Ubuntu 20 with HWE kernel (5.15) already works, RHEL9 works, Oracle's RHEL8 clone OEL8 with Oracle's UEK7 kernel (5.15) also works. Supporting 64-bit x86 and ARM for now (I'm tempted to try it out on RISC-V too). How this approach and method differs from traditional eBPF tracing and systemwide metric collection tools is that xcapture "tracks (not traces) plus samples" all threads' activity in the entire system. This way you can get a systemwide summary of activity (who's spending time on what) and drill down into an individual thread if you want to. Thanks to this method, it is feasible to track+sample all activity all the time, which is not realistic with tracing and not detailed enough with systemwide utilization metrics monitoring. I managed to explain this method in just 10 minutes at last year's eBPF Summit, the 10-minute video is the 1st one you see on 0xtools website [2]. Thanks for reading, waiting for feedback! [1] https://news.ycombinator.com/item?id=40869877 [2] https://0x.tools/
Does the same job
all alternatives →- XPxstack – Passive eBPF Linux stack profiling without tracepoints2025 · tanelpoder.com · ▲6
Here's the latest eBPF performance tool of mine - xstack. It's a minimal tool, just 165 lines of eBPF C and under 500 lines of userland C code (including all comments and boilerplate!). It uses the libbpf and (Rust) BlazeSym libraries though (which are a lot of code). The point (and difference) of this tool is that it can sample both the kernel and userspace stack traces of all threads in your system. Traditionally, the "bpf_get_stack()" helper can not read userspace stack traces of other tasks in Linux, but since Linux 5.18 we can combine sleepable eBPF task iterator programs with a new…
- PIPixie, Instant Kubernetes-Native Application Observability Using EBPF2020 · pixielabs.ai · ▲108
- AUAIOStack – Using eBPF to Secure AI Services in KubernetesJan 2026 · aurva.io · ▲9
Hey HN! We built a tool that uses eBPF to discover AI services and their data flows in Kubernetes clusters. Modern AI apps often follow this pattern: 1. Service receives request 2. Queries database (PostgreSQL/Redis/MongoDB) 3. Sends data to LLM API (OpenAI/Anthropic/Bedrock) 4. Consumes or returns the AI generated response Security teams often don't know: - Which services are making AI calls - What databases they're accessing first - Whether PII is being sent to third-party APIs - What libraries and packages are being used for AI Our eBPF based tool attaches to network…
- POPixie, open source observability for Kubernetes using eBPF2022 · github.com · ▲6
- CXCheerpX – x86 virtualization in browser using WebAssembly – Python Demo2020 · leaningtech.com · ▲26
- TRTrunchbull, run real models against any benchmark in your browser25d ago · trunchbull.dev · ▲6
Hi HN, Today I'm showcasing Trunchbull, a benchmarking platform designed for authoring benchmarks and running them against different models. We have direct support for benchmarks that use the harbor authoring system, custom tool authoring via the vercel ai sdk and configuration limits. We've also already imported terminalbench 2.0, as a sort of proof of concept that our harbor task orchestrator works, although you currently need a paid account as we are provisioning sandbox environments. I've made several popular benchmarks publicly available for testing. You dont need an account or your…
More life & fun this month
the category →- TL
Life & fun · 10d ago · louisabraham.github.io
Photosynthesis fires two of your iPhone
Life & fun · 28d ago · photosynthesis.camera
SoloUno▲310Take control of hair pulling, nail biting & skin picking
Life & fun · 28d ago · solouno.io
Scroll through all 43,252,003,274,489,856,000 reachable Rubik's Cube permutations.
Life & fun · 26d ago · everycube.alen.is
Hi HN, I built Eigendrum, a web tool that solves the 2D wave equation for arbitrary shapes so you can hear what they sound like as drums. How it works: * Solves -∇²u = λu using finite element analysis (Kφ = λMφ) on a triangle mesh. * Validated to <0.1% error against closed-form solutions for circles (Bessel zeros) and rectangles. * Sound model factors in strike location, Rayleigh damping, and mallet width. * Includes Kac drums I & II to demonstrate identical sound spectra from different geometries. * No frameworks, build steps, or dependencies. Repo and tests:…
Life & fun · 27d ago · baselashraf81.github.io
Launched alongside, April 2025
the whole month →- IB
Hi everyone, I built PyXL — a hardware processor that executes a custom assembly generated from Python programs, without using a traditional interpreter or virtual machine. It compiles Python -> CPython Bytecode -> Instruction set designed for direct hardware execution. I’m sharing an early benchmark: a GPIO test where PyXL achieves a 480ns round-trip toggle — compared to 14-25 micro seconds on a MicroPython Pyboard - even though PyXL runs at a lower clock (100MHz vs. 168MHz). The design is stack-based, fully pipelined, and preserves Python's dynamic typing without static type restrictions.…
Dev tools · 2025 · runpyxl.com
- UC
Life & fun · 2025 · filiph.github.io
- IB
https://the-pocket.github.io/Tutorial-Codebase-Knowledge/
AI · 2025 · github.com
