HN
Today

Tracing Goroutines in Realtime with eBPF

Dive deep into the Go runtime with 'xgotop', a new tool that leverages eBPF to trace goroutine lifecycle events and memory allocations in real-time. This article explains the intricate dance between Go's internal structures and eBPF's probing capabilities, demonstrating how to peek into goroutine states, object creations, and slice/map allocations. It's a masterclass in low-level Go observability, satisfying Hacker News's hunger for cutting-edge performance tooling and system-level insights.

18
Score
0
Comments
#19
Highest Rank
4h
on Front Page
First Seen
Apr 5, 4:00 PM
Last Seen
Apr 5, 7:00 PM
Rank Over Time
19242522

The Lowdown

This article introduces xgotop, a new Go runtime tracing tool that uses eBPF to observe goroutine state changes and memory allocations in near real-time. Authored by Ozan Sazak, the creator and winner of the eBPF Summit '25 Hackathon, this is the first part of a series detailing the thought process and implementation behind xgotop.

  • The author explains the lifecycle of a goroutine, highlighting its state transitions and memory operations, which are often too fast to observe with traditional logging.
  • It details how eBPF can hook into specific Go runtime functions in userspace, such as runtime.casgstatus for state changes and runtime.newobject, runtime.makeslice, and runtime.makemap for memory allocations.
  • The article dissects key Go runtime internal structures like runtime.g (representing a goroutine), abi.Type, and abi.MapType, explaining what information can be extracted from their fields.
  • It demonstrates using bpftrace for rapid prototyping of eBPF programs, showing how to define C-style structs to interpret Go runtime data and access function arguments via CPU registers.
  • A practical bpftrace script (xgotop.bt) is provided, along with an example Go HTTP server, to illustrate how to trace goroutine creation, state changes, and various memory allocations (objects, slices, maps) in a running Go application.

This initial installment lays the groundwork for understanding how to use eBPF to gain unprecedented visibility into Go's runtime, with the promise of a second article to transform the bpftrace proof-of-concept into a standalone tool using C, Go, and cilium/ebpf-go.