Alert noise, as well as false positives or too few alerts, undermine the effectiveness of any monitoring solution. Inaccurate alerts condition users to draw poor conclusions. Too many alerts contribute to serious alerts going undetected. Too many false positive or non-actionable alerts cause the significance of all alerts to diminish over time. And too few alerts can lead to misreading system performance and missing critical problems.

I’m not going to lie, I have a strong hatred towards the Berkeley Packet Filter (BPF). There are a lot of reasons mainly having to do with having to support BPF on a network monitoring tool. There’s also the challenge of writing BPF filters and the weird way they work. So when I first heard about eBPF, I was more than a little reluctant to be excited. As I dug in further, I became much more excited about the technology and the benefits it can bring. So, what is eBPF then?

Wouldn’t it be great if there was some attribute you could query and set on a device? Then you could automagically configure that device based on that attribute that you just set for fully automated device onboarding! Welcome to Dynamic Device Attribute Pollers and Auto-Configuration Parameters! Rolls right off the tongue doesn’t it?