Extending BCC as a Data Source for System Monitoring

### Overview In this talk, an engineer from LG Electronics introduces an approach and patch to extend the BPF Compiler Collection (BCC) as an automated data source for modern system monitoring and diagnostic pipelines. While BCC contains a rich collection of battle-tested, production-ready eBPF tools that offer deep kernel and user space visibility with low overhead, these tools were historically designed for standalone human consumption via the console. This presentation details how BCC tools can output standardized, structured time-series metrics directly without sacrificing BCC's standalone identity.

### Key Topics - **Limitations of Standalone BCC Tools**: Tools like `biolatpct`/`biotop` print human-readable text tables. When updated, text formats frequently change and include non-standard noise like startup banners, making string parsing fragile and resource-heavy for automated pipelines. - **Modern Monitoring Ecosystem Integration**: Modern pipelines collect structured metrics (measurements, labels, values, timestamps) into time-series databases for anomaly detection and graphing. Traditional tools lacked a direct, standard bridge to feed these systems. - **Design Principles for Metric Output**: 1. *Preserving Standalone Nature*: Keep existing human-friendly output intact by default while adding separate command-line options for structured metric emission. 2. *Minimizing Overhead*: Implement direct structured output within BCC rather than relying on external string-scraping wrappers that consume excess CPU and break easily. 3. *Protocol Extensibility*: Decouple the metric extraction interface from wire protocols (e.g., InfluxDB Line Protocol), allowing eBPF experts and monitoring system developers to contribute independently. 4. *Testability and CI Verification*: Implement automated CI tests using standardized protocol specifications to verify structured outputs without requiring external database dependencies.

### Technical Details - **Architecture**: eBPF tools typically consist of an in-kernel program storing data into eBPF maps and a user space program reading and displaying that data. The patch enhances the user space formatting layer. - **Supported Protocols and Examples**: Line protocol was chosen as an initial industry-standard format compatible with time-series databases. Examples were shown comparing the default console table of tools like `biotop` and `syscount` against their formatted line protocol output. - **Unified Diagnostic Dashboards**: By streaming structured data from multiple BCC tools (`biotop`, `syscount`, and a memory reclamation tool) into a time-series database, metrics were visualized simultaneously. This enables tracking I/O spikes, correlating anomalies across subsystems, and establishing baselines for automated or AI-assisted pattern analysis.

### Takeaways - Directly integrating structured metric export inside BCC bridges the gap between low-level eBPF tracing and modern observability backends. - The patch currently supports three BCC tools, with a roadmap to expand across more diagnostic and tracing tools. - Decoupled metric and protocol interfaces make it easy for contributors to add new protocol serializers without needing deep eBPF kernel expertise.