@prefix : . @prefix schema: . @prefix skos: . @prefix rdfs: . @prefix owl: . @prefix prov: . @prefix xsd: . @prefix dbr: . @prefix rdf: . # --------------------------------------------------------------------------- # Lightweight ontology # --------------------------------------------------------------------------- :ontology a owl:Ontology ; schema:name "Tool Already There Ontology"@en ; schema:description "A lightweight ontology modeling the two lineages of built-in production tracing capability (Unix/DTrace and Linux/eBPF) compared in this article, their safety-guarantee properties, and the commercial observability offers contrasted against them."@en ; schema:identifier ; rdfs:label "Tool Already There Ontology"@en ; rdfs:comment "Local classes and properties for modeling built-in tracing approaches and their guarantees."@en . :ObservabilityApproach a rdfs:Class ; rdfs:label "Observability Approach"@en ; rdfs:comment "A lineage of production-system tracing capability, distinguished by how it enforces safety and where it lives in the software stack."@en ; rdfs:isDefinedBy : . :UnixTracingApproach a rdfs:Class ; rdfs:label "Unix Tracing Approach"@en ; rdfs:comment "The DTrace lineage: Sun Microsystems, Solaris, FreeBSD, macOS, safety enforced by a language that cannot express dangerous operations."@en ; rdfs:subClassOf :ObservabilityApproach ; rdfs:isDefinedBy : . :LinuxTracingApproach a rdfs:Class ; rdfs:label "Linux Tracing Approach"@en ; rdfs:comment "The eBPF lineage: BPF, extended BPF, the Linux kernel verifier, and bpftrace as front end."@en ; rdfs:subClassOf :ObservabilityApproach ; rdfs:isDefinedBy : . :hasProbeEffectWhenDisabled a rdf:Property, owl:DatatypeProperty ; rdfs:label "has probe effect when disabled"@en ; rdfs:comment "The stated performance cost of the approach when its instrumentation is switched off."@en ; rdfs:domain :ObservabilityApproach ; rdfs:range xsd:string ; rdfs:isDefinedBy : . :hasSafetyMechanism a rdf:Property, owl:DatatypeProperty ; rdfs:label "has safety mechanism"@en ; rdfs:comment "The mechanism by which the approach guarantees that instrumentation cannot crash the running system."@en ; rdfs:domain :ObservabilityApproach ; rdfs:range xsd:string ; rdfs:isDefinedBy : . :hasOriginYear a rdf:Property, owl:DatatypeProperty ; rdfs:label "has origin year"@en ; rdfs:comment "The year work began on the approach."@en ; rdfs:domain :ObservabilityApproach ; rdfs:range xsd:gYear ; rdfs:isDefinedBy : . :hasKernelMergeYear a rdf:Property, owl:DatatypeProperty ; rdfs:label "has kernel merge year"@en ; rdfs:comment "The year the approach shipped in or merged into its base operating system."@en ; rdfs:domain :ObservabilityApproach ; rdfs:range xsd:gYear ; rdfs:isDefinedBy : . :unixTracingApproach a :UnixTracingApproach ; schema:name "The Unix Tracing Line (DTrace)"@en ; :hasProbeEffectWhenDisabled "zero probe effect: exactly as if DTrace were not present at all"@en ; :hasSafetyMechanism "a language that cannot express the dangerous operations"@en ; :hasOriginYear "2001"^^xsd:gYear ; :hasKernelMergeYear "2005"^^xsd:gYear ; schema:about :dtrace . :linuxTracingApproach a :LinuxTracingApproach ; schema:name "The Linux Tracing Line (eBPF)"@en ; :hasProbeEffectWhenDisabled "zero probe effect when disabled, verified at load time rather than by construction"@en ; :hasSafetyMechanism "a verifier that walks every path before the code may run"@en ; :hasOriginYear "1992"^^xsd:gYear ; :hasKernelMergeYear "2014"^^xsd:gYear ; schema:about :ebpf . # --------------------------------------------------------------------------- # Main article # --------------------------------------------------------------------------- : a schema:CreativeWork ; schema:name "The Tool That Was Already There — Document"@en ; schema:description "Document about the built-in production tracing tools DTrace and eBPF, and why engineers reach for paid observability platforms instead."@en . :analysis a schema:Article ; schema:headline "The Tool That Was Already There"@en ; schema:name "The Tool That Was Already There"@en ; schema:abstract "In 2004 three engineers wrote down what an observability tool must guarantee before anybody may switch it on in production. The Unix line got one, and Linux eventually built its own. The dashboard still gets asked first."@en ; schema:datePublished "2026-08-10"^^xsd:date ; schema:url ; schema:mainEntityOfPage ; schema:author :vivianVoss ; schema:publisher :vivianVoss ; schema:keywords "freebsd"@en, "linux"@en, "observability"@en, "unix"@en ; schema:about dbr:DTrace, dbr:EBPF, ; schema:articleBody "A production system is behaving oddly, and on the same machine sits a tool that could settle the question in forty seconds, already installed and free, while most shops instead open a dashboard and hope the right metric was foreseen."@en ; schema:hasPart :introSection, :section2004, :sectionNotAFeature, :sectionOtherAnswer, :sectionMeasuredBoth, :sectionBill, :sectionLimit, :sectionPoint, :faqSection, :glossarySection, :howtoSection, :unixTracingApproach, :linuxTracingApproach, : ; prov:wasGeneratedBy . :introSection a schema:CreativeWork ; schema:name "Opening: A Production System Behaves Oddly"@en ; schema:abstract "Most shops open a dashboard, hunt for a time window and guess, filing a ticket if the metric was never instrumented, while a free, already-installed tool could answer the same question in forty seconds."@en ; schema:isPartOf :analysis . :section2004 a schema:CreativeWork ; schema:name "What Was Written Down in 2004"@en ; schema:abstract "In 2001 Bryan Cantrill, Michael Shapiro and Adam Leventhal began DTrace at Sun Microsystems; it shipped in Solaris 10 in March 2005 after a USENIX 2004 paper specified absolute safety when enabled and zero probe effect when disabled, across roughly 30,000 kernel instrumentation points."@en ; schema:isPartOf :analysis ; schema:mentions :bryanCantrill, :michaelShapiro, :adamLeventhal, :sunMicrosystems, :solaris10, :usenix, :usenixPaper2004, :klaraSystemsArticle, :dtrace, :dtraceGuaranteesImage . :sectionNotAFeature a schema:CreativeWork ; schema:name "Not a Feature, a Decision About Where Things Live"@en ; schema:abstract "DTrace's zero-cost-when-disabled property let it live in the base system rather than being procured afterwards; it travelled into FreeBSD and macOS as something typed, not bought, embodying the Unix philosophy of a capability rather than one large program."@en ; schema:isPartOf :analysis ; schema:mentions :dtrace, :freebsd, :macos . :sectionOtherAnswer a schema:CreativeWork ; schema:name "The Other Answer"@en ; schema:abstract "Because DTrace's CDDL licence is incompatible with the Linux kernel's GPLv2, Linux built its own answer: the 1992 Berkeley Packet Filter was extended by Alexei Starovoitov and Daniel Borkmann in 2014 into eBPF, merged into Linux 3.18, with safety enforced by a verifier rather than a constrained language, and bpftrace by Alastair Robertson as its front end."@en ; schema:isPartOf :analysis ; schema:mentions :linux, :cddl, :gplv2, :oracle, :bpf, :stevenMcCanne, :vanJacobson, :alexeiStarovoitov, :danielBorkmann, :ebpf, :verifier, :bpftrace, :alastairRobertson, :brendanGregg, :softwareFreedomArticle, :ebpfIoArticle, :kernelVerifierDocs, :bpftraceBlogPost, :tworoutesImage . :sectionMeasuredBoth a schema:CreativeWork ; schema:name "What Happens When Somebody Measures Both"@en ; schema:abstract "Mateusz Piotrowski's AsiaBSDCon 2024 benchmark of DTrace on FreeBSD against eBPF on Linux concludes it is not possible to say which is faster and that any such comparison would be unfair and misinformed, noting only that bpftrace took roughly ten minutes to print statistics in early testing where DTrace took a few seconds."@en ; schema:isPartOf :analysis ; schema:mentions :mateuszPiotrowski, :asiaBsdCon2024, :asiaBsdConProceedings2024, :dtrace, :ebpf, :bpftrace . :sectionBill a schema:CreativeWork ; schema:name "The Bill"@en ; schema:abstract "Observability platforms charge $15/host/month for infrastructure monitoring, $31/host/month for APM, $0.10 per ingested GB of logs and $1.70 per million indexed events; Datadog's list pricing and a Coinbase bill of roughly $65 million for 2021, confirmed via Gergely Orosz's reporting, show the cost has no ceiling."@en ; schema:isPartOf :analysis ; schema:mentions :datadog, :coinbase, :gergelyOrosz, :pragmaticEngineerDatadogArticle, :datadogPricingPage, :infrastructureMonitoringOffer, :apmOffer, :logIngestionOffer, :logIndexingOffer, :billingComparisonImage . :sectionLimit a schema:CreativeWork ; schema:name "The Limit"@en ; schema:abstract "A local tool like DTrace answers only local questions, cannot aggregate across a fleet or retain history, requires a skill that decays without practice, and includes a destructive mode, dtrace -w, that can modify a running kernel."@en ; schema:isPartOf :analysis ; schema:mentions :dtrace . :sectionPoint a schema:CreativeWork ; schema:name "The Point"@en ; schema:abstract "The 2004 specification (zero probe effect disabled, absolute safety enabled, 30,000 kernel instrumentation points) is why DTrace lives in FreeBSD and macOS as something typed rather than bought; Linux built eBPF instead because CDDL and GPLv2 are incompatible; no published comparison names a winner; and the built-in tool costs nothing against an unbounded platform bill."@en ; schema:isPartOf :analysis ; schema:mentions :usenixPaper2004, :dtraceWikipediaArticle, :softwareFreedomArticle, :ebpfIoArticle, :asiaBsdConProceedings2024, :datadogPricingPage . # --------------------------------------------------------------------------- # Images (inline SVG infographics in the source — no discrete contentUrl exists) # --------------------------------------------------------------------------- :dtraceGuaranteesImage a schema:ImageObject ; schema:name "The 2004 Specification Chart"@en ; schema:description "The three guarantees stated in the 2004 DTrace paper: absolutely safe when enabled, zero probe effect when disabled, and roughly thirty thousand instrumentation points in the kernel of even the smallest system."@en ; schema:about :section2004 . :tworoutesImage a schema:ImageObject ; schema:name "Two Routes, One Guarantee Chart"@en ; schema:description "DTrace's path from Sun in 2001 to Solaris 10 in 2005 to FreeBSD and macOS, safety via a language that cannot express dangerous operations, compared with BPF's path from 1992 to eBPF in 2014 to Linux 3.18, safety via a load-time verifier, with bpftrace as the front end."@en ; schema:about :sectionOtherAnswer . :billingComparisonImage a schema:ImageObject ; schema:name "The Same Question, Bought Instead of Typed Chart"@en ; schema:description "Datadog list pricing as of 9 August 2026 — $15/host/month infrastructure monitoring, $31/host/month APM, $0.10 per ingested GB, $1.70 per million indexed events — set against the kernel tool, which costs nothing and is already installed."@en ; schema:about :sectionBill . # --------------------------------------------------------------------------- # Persons # --------------------------------------------------------------------------- :vivianVoss a schema:Person ; schema:name "Vivian Voss"@en ; schema:url ; schema:identifier ; owl:sameAs , . :bryanCantrill a schema:Person ; schema:name "Bryan Cantrill"@en ; schema:url ; schema:identifier ; owl:sameAs dbr:Bryan_Cantrill . :michaelShapiro a schema:Person ; schema:name "Michael Shapiro"@en . :adamLeventhal a schema:Person ; schema:name "Adam Leventhal"@en . :stevenMcCanne a schema:Person ; schema:name "Steven McCanne"@en . :vanJacobson a schema:Person ; schema:name "Van Jacobson"@en ; owl:sameAs dbr:Van_Jacobson . :alexeiStarovoitov a schema:Person ; schema:name "Alexei Starovoitov"@en ; schema:url ; schema:identifier . :danielBorkmann a schema:Person ; schema:name "Daniel Borkmann"@en . :alastairRobertson a schema:Person ; schema:name "Alastair Robertson"@en . :brendanGregg a schema:Person ; schema:name "Brendan Gregg"@en ; schema:url ; schema:identifier ; owl:sameAs dbr:Brendan_Gregg . :mateuszPiotrowski a schema:Person ; schema:name "Mateusz Piotrowski"@en ; schema:url ; schema:identifier . :gergelyOrosz a schema:Person ; schema:name "Gergely Orosz"@en ; schema:url ; schema:identifier . # --------------------------------------------------------------------------- # Organizations # --------------------------------------------------------------------------- dbr:Sun_Microsystems a schema:Organization ; schema:name "Sun Microsystems"@en . dbr:Oracle_Corporation a schema:Organization ; schema:name "Oracle"@en . dbr:Datadog a schema:Organization ; schema:name "Datadog"@en . dbr:Coinbase a schema:Organization ; schema:name "Coinbase"@en . dbr:USENIX a schema:Organization ; schema:name "USENIX"@en . # Local aliases so the rest of the graph can reference organizations via short names :sunMicrosystems owl:sameAs dbr:Sun_Microsystems . :oracle owl:sameAs dbr:Oracle_Corporation . :datadog owl:sameAs dbr:Datadog . :coinbase owl:sameAs dbr:Coinbase . :usenix owl:sameAs dbr:USENIX . # --------------------------------------------------------------------------- # Software / platforms # --------------------------------------------------------------------------- dbr:DTrace a schema:SoftwareApplication ; schema:name "DTrace"@en ; schema:description "Dynamic tracing framework built at Sun Microsystems, shipped with Solaris 10 in March 2005, later ported to FreeBSD and macOS."@en . :dtrace a schema:DefinedTerm ; owl:sameAs dbr:DTrace ; schema:name "DTrace"@en ; schema:description "Dynamic tracing framework built at Sun Microsystems, shipped with Solaris 10 in March 2005, later ported to FreeBSD and macOS."@en ; schema:isPartOf :glossarySection . dbr:EBPF a schema:SoftwareApplication ; schema:name "eBPF"@en ; schema:description "Extended Berkeley Packet Filter: a verified in-kernel virtual machine for Linux, developed from 2014 by Alexei Starovoitov and Daniel Borkmann, merged into Linux 3.18."@en . :ebpf a schema:DefinedTerm ; owl:sameAs dbr:EBPF ; schema:name "eBPF"@en ; schema:description "Extended Berkeley Packet Filter: a verified in-kernel virtual machine for Linux, merged into Linux 3.18."@en ; schema:isPartOf :glossarySection . dbr:Berkeley_Packet_Filter a schema:SoftwareApplication ; schema:name "Berkeley Packet Filter"@en ; schema:description "1992 in-kernel packet-filtering virtual machine by Steven McCanne and Van Jacobson, later extended into eBPF."@en . :bpf a schema:DefinedTerm ; owl:sameAs dbr:Berkeley_Packet_Filter ; schema:name "Berkeley Packet Filter"@en ; schema:description "1992 in-kernel packet-filtering virtual machine, later extended into eBPF."@en ; schema:isPartOf :glossarySection . :bpftrace a schema:SoftwareApplication, schema:DefinedTerm ; schema:name "bpftrace"@en ; schema:description "High-level tracing front end for eBPF, written by Alastair Robertson with Brendan Gregg among its principal contributors, shaped to feel familiar to DTrace users."@en ; schema:url ; schema:creator :alastairRobertson ; schema:isPartOf :glossarySection . a schema:SoftwareApplication ; schema:name "Solaris"@en . :solaris10 owl:sameAs ; schema:name "Solaris 10"@en ; rdfs:comment "The Solaris release, shipped March 2005, that first bundled DTrace."@en . dbr:FreeBSD a schema:SoftwareApplication ; schema:name "FreeBSD"@en . :freebsd owl:sameAs dbr:FreeBSD . dbr:Linux a schema:SoftwareApplication ; schema:name "Linux"@en . :linux owl:sameAs dbr:Linux . dbr:MacOS a schema:SoftwareApplication ; schema:name "macOS"@en . :macos owl:sameAs dbr:MacOS . # --------------------------------------------------------------------------- # Licenses # --------------------------------------------------------------------------- dbr:Common_Development_and_Distribution_License a schema:CreativeWork ; schema:name "Common Development and Distribution License"@en . :cddl a schema:DefinedTerm ; owl:sameAs dbr:Common_Development_and_Distribution_License ; schema:name "CDDL"@en ; schema:description "Common Development and Distribution License — the licence DTrace is published under."@en ; schema:isPartOf :glossarySection . dbr:GNU_General_Public_License a schema:CreativeWork ; schema:name "GNU General Public License"@en . :gplv2 a schema:DefinedTerm ; owl:sameAs dbr:GNU_General_Public_License ; schema:name "GPLv2"@en ; schema:description "GNU General Public License v2 — the licence of the Linux kernel, incompatible with CDDL."@en ; schema:isPartOf :glossarySection . # --------------------------------------------------------------------------- # Concepts / defined terms referenced in body prose (beyond glossary section entries) # --------------------------------------------------------------------------- :verifier a schema:DefinedTerm ; schema:name "Verifier"@en ; schema:description "The eBPF load-time static analyser that walks every possible execution path, forbidding loops, invalid jumps, invalid memory access and kernel-data leaks, before a program may run."@en ; schema:isPartOf :glossarySection . # --------------------------------------------------------------------------- # Events # --------------------------------------------------------------------------- :asiaBsdCon2024 a schema:Event ; schema:name "AsiaBSDCon 2024"@en ; schema:startDate "2024"^^xsd:gYear . :usenixAtc2004 a schema:Event ; schema:name "USENIX ATC 2004"@en ; schema:startDate "2004"^^xsd:gYear ; schema:organizer :usenix . # --------------------------------------------------------------------------- # Cited works # --------------------------------------------------------------------------- :usenixPaper2004 a schema:ScholarlyArticle ; schema:name "Dynamic Instrumentation of Production Systems"@en ; schema:url ; schema:author :bryanCantrill, :michaelShapiro, :adamLeventhal ; schema:isPartOf :usenixAtc2004 ; schema:datePublished "2004"^^xsd:gYear . :klaraSystemsArticle a schema:Article ; schema:name "FreeBSD History: Understanding the Origins of DTrace"@en ; schema:url . :softwareFreedomArticle a schema:Article ; schema:name "GPL Violations Related to Combining ZFS and Linux"@en ; schema:url ; schema:about :cddl, :gplv2 . :ebpfIoArticle a schema:Article ; schema:name "What is eBPF?"@en ; schema:url ; schema:about :ebpf . :kernelVerifierDocs a schema:TechArticle ; schema:name "eBPF Verifier"@en ; schema:url ; schema:about :verifier . :bpftraceBlogPost a schema:Article ; schema:name "bpftrace"@en ; schema:url ; schema:author :brendanGregg ; schema:about :bpftrace . :asiaBsdConProceedings2024 a schema:Article ; schema:name "Benchmarking Performance Overhead of DTrace on FreeBSD and eBPF on Linux"@en ; schema:url ; schema:author :mateuszPiotrowski ; schema:isPartOf :asiaBsdCon2024 . :datadogPricingPage a schema:WebPage ; schema:name "Datadog Pricing"@en ; schema:url ; schema:about :datadog ; schema:dateModified "2026-08-09"^^xsd:date . :pragmaticEngineerDatadogArticle a schema:Article ; schema:name "The Mystery of the $65M Datadog Bill"@en ; schema:url ; schema:author :gergelyOrosz ; schema:about :coinbase, :datadog . :dtraceWikipediaArticle a schema:Article ; schema:name "DTrace"@en ; schema:url ; schema:about :dtrace . # --------------------------------------------------------------------------- # Pricing offers ("The Bill") # --------------------------------------------------------------------------- :infrastructureMonitoringOffer a schema:Offer ; schema:name "Infrastructure Monitoring"@en ; schema:seller :datadog ; schema:priceSpecification :infrastructureMonitoringPrice . :infrastructureMonitoringPrice a schema:UnitPriceSpecification ; schema:price "15.00"^^xsd:decimal ; schema:priceCurrency "USD"@en ; schema:unitText "per host, per month"@en . :apmOffer a schema:Offer ; schema:name "Application Performance Monitoring"@en ; schema:seller :datadog ; schema:priceSpecification :apmPrice . :apmPrice a schema:UnitPriceSpecification ; schema:price "31.00"^^xsd:decimal ; schema:priceCurrency "USD"@en ; schema:unitText "per host, per month"@en . :logIngestionOffer a schema:Offer ; schema:name "Log Ingestion"@en ; schema:seller :datadog ; schema:priceSpecification :logIngestionPrice . :logIngestionPrice a schema:UnitPriceSpecification ; schema:price "0.10"^^xsd:decimal ; schema:priceCurrency "USD"@en ; schema:unitText "per ingested GB"@en . :logIndexingOffer a schema:Offer ; schema:name "Log Indexing"@en ; schema:seller :datadog ; schema:priceSpecification :logIndexingPrice . :logIndexingPrice a schema:UnitPriceSpecification ; schema:price "1.70"^^xsd:decimal ; schema:priceCurrency "USD"@en ; schema:unitText "per million events"@en . :coinbaseDatadogBill a schema:CreativeWork ; schema:name "Coinbase's Reported 2021 Datadog Bill"@en ; schema:description "Approximately $65 million for the year 2021, inferred from a remark on Datadog's 4 May 2023 earnings call and confirmed by current and former engineers via Gergely Orosz's reporting."@en ; schema:about :coinbase, :datadog ; schema:citation :pragmaticEngineerDatadogArticle . # --------------------------------------------------------------------------- # FAQ # --------------------------------------------------------------------------- :faqSection a schema:FAQPage ; schema:name "Frequently Asked Questions"@en ; schema:isPartOf :analysis ; schema:mainEntity :q1, :q2, :q3, :q4, :q5, :q6, :q7, :q8, :q9, :q10, :q11, :q12, :q13, :q14 . :q1 a schema:Question ; schema:name "What did the 2004 DTrace paper specify?"@en ; schema:isPartOf :faqSection ; schema:acceptedAnswer :a1 . :a1 a schema:Answer ; schema:text "It specified that dynamic instrumentation must be absolutely safe when enabled and have zero probe effect when disabled, with on the order of 30,000 instrumentation points available in the kernel of even the smallest system."@en . :q2 a schema:Question ; schema:name "Who built DTrace and where?"@en ; schema:isPartOf :faqSection ; schema:acceptedAnswer :a2 . :a2 a schema:Answer ; schema:text "Bryan Cantrill, Michael Shapiro and Adam Leventhal built it at Sun Microsystems, taking twenty-three months to the first integration; it shipped with Solaris 10 in March 2005."@en . :q3 a schema:Question ; schema:name "What does 'zero probe effect' mean?"@en ; schema:isPartOf :faqSection ; schema:acceptedAnswer :a3 . :a3 a schema:Answer ; schema:text "When DTrace is not explicitly enabled, the system operates exactly as if DTrace were not present at all — not one per cent of overhead, not half of one, nothing."@en . :q4 a schema:Question ; schema:name "Why is DTrace a decision about where a capability lives, not just a feature?"@en ; schema:isPartOf :faqSection ; schema:acceptedAnswer :a4 . :a4 a schema:Answer ; schema:text "Because it costs nothing while switched off, DTrace can sit in the base system rather than being procured afterwards, which is why it ships as something typed in FreeBSD and macOS rather than something bought."@en . :q5 a schema:Question ; schema:name "Why couldn't DTrace simply be merged into the Linux kernel?"@en ; schema:isPartOf :faqSection ; schema:acceptedAnswer :a5 . :a5 a schema:Answer ; schema:text "DTrace is published under the CDDL and the Linux kernel is GPLv2; the two licences are incompatible, so a CDDL-licensed tracing framework cannot simply be merged into a GPLv2 kernel."@en . :q6 a schema:Question ; schema:name "What is eBPF and where did it come from?"@en ; schema:isPartOf :faqSection ; schema:acceptedAnswer :a6 . :a6 a schema:Answer ; schema:text "eBPF is Alexei Starovoitov and Daniel Borkmann's 2014 extension of the 1992 Berkeley Packet Filter into a full virtual machine with ten registers, a 512-byte stack, a JIT compiler and a verifier, merged into Linux 3.18."@en . :q7 a schema:Question ; schema:name "How does eBPF guarantee safety differently from DTrace?"@en ; schema:isPartOf :faqSection ; schema:acceptedAnswer :a7 . :a7 a schema:Answer ; schema:text "DTrace constrains what can be written, using a language with no loops or arbitrary control flow, so a dangerous script is not expressible in the first place; eBPF admits arbitrary programs and then proves them safe with a verifier that statically walks every possible path at load time."@en . :q8 a schema:Question ; schema:name "What is bpftrace?"@en ; schema:isPartOf :faqSection ; schema:acceptedAnswer :a8 . :a8 a schema:Answer ; schema:text "bpftrace is a high-level front end sitting on top of eBPF, written by Alastair Robertson with Brendan Gregg among its principal contributors, deliberately shaped so that someone experienced with DTrace finds their way about at once."@en . :q9 a schema:Question ; schema:name "Which is faster, DTrace or eBPF?"@en ; schema:isPartOf :faqSection ; schema:acceptedAnswer :a9 . :a9 a schema:Answer ; schema:text "Mateusz Piotrowski's AsiaBSDCon 2024 benchmark concludes it is not possible to say which system is faster, since any such comparison would be unfair and misinformed given how many factors differ between the two entirely different pieces of software."@en . :q10 a schema:Question ; schema:name "What did Piotrowski's benchmarking find about start-up and shutdown behavior?"@en ; schema:isPartOf :faqSection ; schema:acceptedAnswer :a10 . :a10 a schema:Answer ; schema:text "During early experimentation, bpftrace took roughly ten minutes to print its collected statistics and quit, where DTrace, when signalled, was done in a few seconds; he records this as an open question for the bpftrace community rather than a verdict."@en . :q11 a schema:Question ; schema:name "How much do commercial observability platforms cost?"@en ; schema:isPartOf :faqSection ; schema:acceptedAnswer :a11 . :a11 a schema:Answer ; schema:text "Datadog's list pricing charges $15 per host per month for infrastructure monitoring, $31 per host per month for application performance monitoring, $0.10 per ingested gigabyte of logs, and $1.70 per million indexed log events."@en . :q12 a schema:Question ; schema:name "How large can an observability bill grow?"@en ; schema:isPartOf :faqSection ; schema:acceptedAnswer :a12 . :a12 a schema:Answer ; schema:text "Coinbase's Datadog bill for 2021 was reported at roughly $65 million, inferred from a remark on Datadog's 4 May 2023 earnings call and confirmed by current and former engineers through Gergely Orosz's reporting."@en . :q13 a schema:Question ; schema:name "What can't a local tool like DTrace do?"@en ; schema:isPartOf :faqSection ; schema:acceptedAnswer :a13 . :a13 a schema:Answer ; schema:text "A local tool answers only local questions: it says nothing about the machines beside it, and does not solve fleet-wide aggregation, months of history retention, or following one request through seven services."@en . :q14 a schema:Question ; schema:name "What is dtrace -w and why does it matter?"@en ; schema:isPartOf :faqSection ; schema:acceptedAnswer :a14 . :a14 a schema:Answer ; schema:text "dtrace -w is a destructive mode that can modify a running kernel; it is separately gated and requires a deliberate decision, but an operator who grants it has granted something serious."@en . # --------------------------------------------------------------------------- # Glossary # --------------------------------------------------------------------------- :glossarySection a skos:ConceptScheme, schema:DefinedTermSet ; schema:name "Glossary"@en ; schema:isPartOf :analysis ; schema:hasDefinedTerm :dtrace, :ebpf, :bpf, :bpftrace, :verifier, :cddl, :gplv2, :term-zero-probe-effect, :term-dynamic-instrumentation, :term-production-system, :term-base-system, :term-observability . :term-zero-probe-effect a schema:DefinedTerm ; schema:name "Zero Probe Effect"@en ; schema:description "The property that when instrumentation is not explicitly enabled, the system behaves exactly as if it were not present at all — no measurable overhead."@en ; schema:isPartOf :glossarySection . :term-dynamic-instrumentation a schema:DefinedTerm ; schema:name "Dynamic Instrumentation"@en ; schema:description "The ability to add tracing probes to a running system's user-level and kernel-level software without stopping or restarting it."@en ; schema:isPartOf :glossarySection . :term-production-system a schema:DefinedTerm ; schema:name "Production System"@en ; schema:description "A live system serving real customers, as distinct from one running in a lab or at small scale, where both traditional measurement approaches stop working."@en ; schema:isPartOf :glossarySection . :term-base-system a schema:DefinedTerm ; schema:name "Base System"@en ; schema:description "The software shipped as part of an operating system's core install, which a capability can join rather than being procured and installed afterwards."@en ; schema:isPartOf :glossarySection . :term-observability a schema:DefinedTerm ; schema:name "Observability"@en ; schema:description "The capacity to ask arbitrary questions about the internal state of a running system from its externally visible outputs."@en ; schema:isPartOf :glossarySection . # --------------------------------------------------------------------------- # HowTo — the diagnostic workflow the article contrasts # --------------------------------------------------------------------------- :howtoSection a schema:HowTo ; schema:name "What Happens When a Production System Behaves Oddly"@en ; schema:isPartOf :analysis ; schema:step :step1, :step2, :step3, :step4, :step5 . :step1 a schema:HowToStep ; schema:name "Open the dashboard"@en ; schema:text "Somebody opens a web interface and hunts for the right time window."@en ; schema:position 1 ; schema:isPartOf :howtoSection . :step2 a schema:HowToStep ; schema:name "Overlay the curves"@en ; schema:text "Two curves are laid on top of one another and the investigator begins to guess."@en ; schema:position 2 ; schema:isPartOf :howtoSection . :step3 a schema:HowToStep ; schema:name "File a ticket if the metric is missing"@en ; schema:text "If the quantity wanted is not among the dashboarded metrics, a ticket is written so it will be emitted from the next deployment onwards — an answer in a fortnight, with luck."@en ; schema:position 3 ; schema:isPartOf :howtoSection . :step4 a schema:HowToStep ; schema:name "Recognize the tool that is already there"@en ; schema:text "On the same machine sits a tool — DTrace or eBPF/bpftrace — that could settle the question in forty seconds: installed, free, and requiring no advance instrumentation of a field."@en ; schema:position 4 ; schema:isPartOf :howtoSection . :step5 a schema:HowToStep ; schema:name "Ask whether anybody in the room can drive it"@en ; schema:text "The determining question is not whether the quantity is in the dashboard, but whether anybody present can drive the built-in tool; if so, the answer costs forty seconds, if not, it costs a fortnight and an unbounded line item."@en ; schema:position 5 ; schema:isPartOf :howtoSection .