{"id":5780,"date":"2026-09-28T14:28:00","date_gmt":"2026-09-28T11:28:00","guid":{"rendered":"https:\/\/www.dchost.com\/blog\/?p=5780"},"modified":"2026-09-28T06:26:17","modified_gmt":"2026-09-28T03:26:17","slug":"ebpf-linux-sunucuda-sorun-teshisi","status":"publish","type":"post","link":"https:\/\/www.dchost.com\/blog\/ebpf-linux-sunucuda-sorun-teshisi\/","title":{"rendered":"eBPF ile Linux Sunucuda Sorun Te\u015fhisi"},"content":{"rendered":"<div class=\"dchost-blog-content-wrapper\"><div class=\"aiw-summary\">\n<p class=\"aiw-box-title\">H\u0131zl\u0131 \u00f6zet<\/p>\n<p>CPU y\u00fckselmesi, a\u011f gecikmesi, disk beklemeleri veya beklenmeyen s\u00fcre\u00e7 davran\u0131\u015flar\u0131 yaln\u0131zca loglara yans\u0131mayabilir. eBPF, Linux \u00e7ekirde\u011finde \u00e7al\u0131\u015fan k\u00fc\u00e7\u00fck programlarla sistemi yeniden ba\u015flatmadan d\u00fc\u015f\u00fck seviyeli olaylar\u0131 g\u00f6zlemlemenizi sa\u011flar.<\/p>\n<ul>\n<li>\u00d6nce belirtinin hangi katmanda olu\u015ftu\u011funu belirleyin; CPU, a\u011f, disk ve s\u00fcre\u00e7 sorunlar\u0131n\u0131 ayn\u0131 komutla incelemeyin.<\/li>\n<li>Linux sunucu izleme i\u00e7in bpftrace, BCC veya bpftool ara\u00e7lar\u0131ndan uygun olan\u0131 se\u00e7in ve \u00fcretim sisteminde dar kapsaml\u0131 problarla ba\u015flay\u0131n.<\/li>\n<li>Te\u015fhis komutunu \u00e7al\u0131\u015ft\u0131rmadan \u00f6nce \u00e7ekirdek, ara\u00e7, yetki ve sembol deste\u011fini kontrol edin.<\/li>\n<li>\u00d6l\u00e7\u00fcm\u00fc bir zaman aral\u0131\u011f\u0131, s\u00fcre\u00e7, ba\u011flant\u0131 noktas\u0131 veya disk ile s\u0131n\u0131rlay\u0131n; aksi halde g\u00f6zlemin kendisi g\u00fcr\u00fclt\u00fc ve ek y\u00fck olu\u015fturabilir.<\/li>\n<\/ul>\n<\/div>\n<p>Bir sunucuda CPU kullan\u0131m\u0131 y\u00fckseldi\u011finde ilk bak\u0131lan yer genellikle uygulama loglar\u0131d\u0131r. Ancak loglar \u00e7o\u011fu zaman iste\u011fin ne zaman reddedildi\u011fini g\u00f6sterir; \u00e7ekirde\u011fin hangi s\u00fcre\u00e7leri \u00e7al\u0131\u015ft\u0131rmak i\u00e7in bekletti\u011fini, bir diskin ne kadar s\u00fcre kuyru\u011fa girdi\u011fini veya TCP ba\u011flant\u0131s\u0131n\u0131n hangi a\u015famada gecikti\u011fini g\u00f6stermez.<\/p>\n<p>eBPF, Linux \u00e7ekirde\u011finde belirli olay noktalar\u0131na g\u00fcvenli bi\u00e7imde g\u00f6zlem kodu ba\u011flaman\u0131z\u0131 sa\u011flayan bir teknolojidir. \u00c7ekirdek kaynak kodunu de\u011fi\u015ftirmeden sistem \u00e7a\u011fr\u0131lar\u0131n\u0131, zamanlay\u0131c\u0131 davran\u0131\u015f\u0131n\u0131, a\u011f paketlerini ve dosya eri\u015fimlerini izleyebilirsiniz. Bu yakla\u015f\u0131m, klasik loglar\u0131 de\u011fi\u015ftirmez; onlar\u0131n a\u00e7\u0131klayamad\u0131\u011f\u0131 zaman \u00e7izelgesini tamamlar.<\/p>\n<p>Buradaki ama\u00e7, her metri\u011fi ayn\u0131 anda toplamak de\u011fil, belirti ile k\u00f6k neden aras\u0131ndaki bo\u015flu\u011fu daraltmakt\u0131r. \u00d6rnek komutlar Linux sunucuda sudo yetkisi, eBPF ile uyumlu bir \u00e7ekirdek ve ilgili ara\u00e7lar\u0131n kurulu oldu\u011fu varsay\u0131m\u0131yla verilir. Da\u011f\u0131t\u0131m\u0131n\u0131z\u0131n \u00e7ekirdek s\u00fcr\u00fcm\u00fc, paket s\u00fcr\u00fcmleri ve yetki politikas\u0131 nedeniyle komutlarda farkl\u0131l\u0131k olu\u015fabilir.<\/p>\n<div id=\"toc_container\" role=\"navigation\" aria-label=\"Table of Contents\" data-nosnippet class=\"toc_transparent no_bullets toc_numbered toc_title_center\"><p class=\"toc_title\">\u0130\u00e7indekiler<\/p><ul class=\"toc_list\"><li><a href=\"#eBPF_hangi_sorulari_yanitlar\"><span class=\"toc_number toc_depth_1\">1.<\/span> eBPF hangi sorular\u0131 yan\u0131tlar?<\/a><ul><li><a href=\"#CPU_yuksek_ama_surec_kullanimi_aciklamiyor\"><span class=\"toc_number toc_depth_2\">1.1.<\/span> CPU y\u00fcksek ama s\u00fcre\u00e7 kullan\u0131m\u0131 a\u00e7\u0131klam\u0131yor<\/a><\/li><li><a href=\"#Ag_gecikmesi_uygulamadan_mi_kaynaklaniyor\"><span class=\"toc_number toc_depth_2\">1.2.<\/span> A\u011f gecikmesi uygulamadan m\u0131 kaynaklan\u0131yor?<\/a><\/li><li><a href=\"#Disk_yavas_mi_surec_mi_yanlis_calisiyor\"><span class=\"toc_number toc_depth_2\">1.3.<\/span> Disk yava\u015f m\u0131, s\u00fcre\u00e7 mi yanl\u0131\u015f \u00e7al\u0131\u015f\u0131yor?<\/a><\/li><\/ul><\/li><li><a href=\"#Kurulumdan_once_guvenli_gozlem_plani\"><span class=\"toc_number toc_depth_1\">2.<\/span> Kurulumdan \u00f6nce g\u00fcvenli g\u00f6zlem plan\u0131<\/a><ul><li><a href=\"#On_kosullari_dogrulayin\"><span class=\"toc_number toc_depth_2\">2.1.<\/span> \u00d6n ko\u015fullar\u0131 do\u011frulay\u0131n<\/a><\/li><li><a href=\"#Yetki_ve_guvenlik_sinirlarini_belirleyin\"><span class=\"toc_number toc_depth_2\">2.2.<\/span> Yetki ve g\u00fcvenlik s\u0131n\u0131rlar\u0131n\u0131 belirleyin<\/a><\/li><li><a href=\"#FPM_CLI_ve_kuyruk_sureclerini_ayirin\"><span class=\"toc_number toc_depth_2\">2.3.<\/span> FPM, CLI ve kuyruk s\u00fcre\u00e7lerini ay\u0131r\u0131n<\/a><\/li><\/ul><\/li><li><a href=\"#CPU_ve_surec_davranisini_eBPF_ile_inceleme\"><span class=\"toc_number toc_depth_1\">3.<\/span> CPU ve s\u00fcre\u00e7 davran\u0131\u015f\u0131n\u0131 eBPF ile inceleme<\/a><ul><li><a href=\"#Dar_kapsamli_profil_ornegi\"><span class=\"toc_number toc_depth_2\">3.1.<\/span> Dar kapsaml\u0131 profil \u00f6rne\u011fi<\/a><\/li><li><a href=\"#Sistem_cagri_yogunlugunu_gorun\"><span class=\"toc_number toc_depth_2\">3.2.<\/span> Sistem \u00e7a\u011fr\u0131 yo\u011funlu\u011funu g\u00f6r\u00fcn<\/a><\/li><\/ul><\/li><li><a href=\"#Ag_gecikmesini_katmanlarina_ayirma\"><span class=\"toc_number toc_depth_1\">4.<\/span> A\u011f gecikmesini katmanlar\u0131na ay\u0131rma<\/a><ul><li><a href=\"#TCP_baglanti_girisimlerini_izleme\"><span class=\"toc_number toc_depth_2\">4.1.<\/span> TCP ba\u011flant\u0131 giri\u015fimlerini izleme<\/a><\/li><li><a href=\"#Yeniden_iletim_ve_ag_kaybini_yorumlayin\"><span class=\"toc_number toc_depth_2\">4.2.<\/span> Yeniden iletim ve a\u011f kayb\u0131n\u0131 yorumlay\u0131n<\/a><\/li><\/ul><\/li><li><a href=\"#Disk_erisimi_ve_IO_beklemelerini_ayirma\"><span class=\"toc_number toc_depth_1\">5.<\/span> Disk eri\u015fimi ve I\/O beklemelerini ay\u0131rma<\/a><ul><li><a href=\"#Blok_IO_gecikmesini_olcme\"><span class=\"toc_number toc_depth_2\">5.1.<\/span> Blok I\/O gecikmesini \u00f6l\u00e7me<\/a><\/li><li><a href=\"#Veri_degisikliginden_once_siniri_koruyun\"><span class=\"toc_number toc_depth_2\">5.2.<\/span> Veri de\u011fi\u015fikli\u011finden \u00f6nce s\u0131n\u0131r\u0131 koruyun<\/a><\/li><\/ul><\/li><li><a href=\"#Surec_dosya_ve_cekirdek_olaylarini_birlikte_dogrulama\"><span class=\"toc_number toc_depth_1\">6.<\/span> S\u00fcre\u00e7, dosya ve \u00e7ekirdek olaylar\u0131n\u0131 birlikte do\u011frulama<\/a><ul><li><a href=\"#Bir_teshis_akisi_kurun\"><span class=\"toc_number toc_depth_2\">6.1.<\/span> Bir te\u015fhis ak\u0131\u015f\u0131 kurun<\/a><\/li><li><a href=\"#Kernel_seviyesindeki_belirtilerde_dikkat\"><span class=\"toc_number toc_depth_2\">6.2.<\/span> Kernel seviyesindeki belirtilerde dikkat<\/a><\/li><\/ul><\/li><li><a href=\"#Arac_secimi_bpftrace_BCC_ve_hazir_gozlem_araclari\"><span class=\"toc_number toc_depth_1\">7.<\/span> Ara\u00e7 se\u00e7imi: bpftrace, BCC ve haz\u0131r g\u00f6zlem ara\u00e7lar\u0131<\/a><\/li><li><a href=\"#Sik_Sorulan_Sorular\"><span class=\"toc_number toc_depth_1\">8.<\/span> S\u0131k Sorulan Sorular<\/a><ul><li><a href=\"#eBPF_kullanmak_icin_uygulamanin_kodunu_degistirmek_gerekir_mi\"><span class=\"toc_number toc_depth_2\">8.1.<\/span> eBPF kullanmak i\u00e7in uygulaman\u0131n kodunu de\u011fi\u015ftirmek gerekir mi?<\/a><\/li><li><a href=\"#eBPF_uretim_sunucusunu_yavaslatir_mi\"><span class=\"toc_number toc_depth_2\">8.2.<\/span> eBPF \u00fcretim sunucusunu yava\u015flat\u0131r m\u0131?<\/a><\/li><li><a href=\"#eBPF_loglarin_yerini_alir_mi\"><span class=\"toc_number toc_depth_2\">8.3.<\/span> eBPF loglar\u0131n yerini al\u0131r m\u0131?<\/a><\/li><li><a href=\"#Her_Linux_dagitiminda_ayni_komutlar_calisir_mi\"><span class=\"toc_number toc_depth_2\">8.4.<\/span> Her Linux da\u011f\u0131t\u0131m\u0131nda ayn\u0131 komutlar \u00e7al\u0131\u015f\u0131r m\u0131?<\/a><\/li><\/ul><\/li><li><a href=\"#Uygulanabilir_son_kontrol_listesi\"><span class=\"toc_number toc_depth_1\">9.<\/span> Uygulanabilir son kontrol listesi<\/a><\/li><\/ul><\/div>\n<h2><span id=\"eBPF_hangi_sorulari_yanitlar\">eBPF hangi sorular\u0131 yan\u0131tlar?<\/span><\/h2>\n<p>eBPF ile g\u00f6zlem yaparken \u00f6nce \u00f6l\u00e7mek istedi\u011finiz davran\u0131\u015f\u0131 bir soruya d\u00f6n\u00fc\u015ft\u00fcr\u00fcn. &#8220;Sunucu yava\u015f&#8221; ifadesi te\u015fhis i\u00e7in geni\u015ftir. &#8220;\u0130stek i\u015fleyen s\u00fcre\u00e7 CPU i\u00e7in mi bekliyor, disk okumas\u0131 m\u0131 gecikiyor?&#8221; daha \u00f6l\u00e7\u00fclebilir bir sorudur.<\/p>\n<h3><span id=\"CPU_yuksek_ama_surec_kullanimi_aciklamiyor\">CPU y\u00fcksek ama s\u00fcre\u00e7 kullan\u0131m\u0131 a\u00e7\u0131klam\u0131yor<\/span><\/h3>\n<p>Standart ara\u00e7lar CPU y\u00fczdesini g\u00f6sterir, fakat bu y\u00fczdelerin kullan\u0131c\u0131 alan\u0131nda m\u0131, \u00e7ekirdek alan\u0131nda m\u0131, yoksa sanal makinenin \u00e7al\u0131nan zaman\u0131nda m\u0131 olu\u015ftu\u011funu her zaman ay\u0131rmaz. eBPF tabanl\u0131 profil \u00f6rneklemesi, belirli aral\u0131klarla \u00e7al\u0131\u015fan \u00e7a\u011fr\u0131 y\u0131\u011f\u0131nlar\u0131n\u0131 toplar. B\u00f6ylece s\u00fcre\u00e7 i\u00e7inde hangi kod yolunun daha fazla zaman t\u00fcketti\u011fine dair bir y\u00f6n elde edersiniz.<\/p>\n<p>Bu \u00f6l\u00e7\u00fcm, kesin bir i\u015flem s\u00fcresi hesab\u0131 de\u011fildir. \u00d6rnekleme s\u0131kl\u0131\u011f\u0131, sembol bilgisi ve derleyici optimizasyonlar\u0131 sonucu etkiler. Yine de uygulama loglar\u0131nda g\u00f6r\u00fcnmeyen yo\u011fun d\u00f6ng\u00fc, kilit beklemesi veya \u00e7ekirdek \u00e7a\u011fr\u0131s\u0131 e\u011filimini ortaya \u00e7\u0131karabilir.<\/p>\n<h3><span id=\"Ag_gecikmesi_uygulamadan_mi_kaynaklaniyor\">A\u011f gecikmesi uygulamadan m\u0131 kaynaklan\u0131yor?<\/span><\/h3>\n<p>Bir HTTP iste\u011finin yava\u015f olmas\u0131; DNS, TCP ba\u011flant\u0131s\u0131, TLS el s\u0131k\u0131\u015fmas\u0131, uzak servis, yerel kuyruk veya uygulama i\u015flem s\u00fcresinden kaynaklanabilir. eBPF ara\u00e7lar\u0131 TCP ba\u011flant\u0131 kurulumu, yeniden iletim ve soket davran\u0131\u015f\u0131 gibi olaylar\u0131 uygulama loglar\u0131ndan ba\u011f\u0131ms\u0131z olarak g\u00f6zlemlemenize yard\u0131m eder.<\/p>\n<p>A\u011f katman\u0131nda g\u00f6r\u00fclen gecikme, do\u011frudan kullan\u0131c\u0131ya d\u00f6nen toplam yan\u0131t s\u00fcresi de\u011fildir. A\u011f olay\u0131n\u0131 uygulaman\u0131n istek s\u00fcresiyle ve d\u0131\u015f izleme verisiyle kar\u015f\u0131la\u015ft\u0131rman\u0131z gerekir.<\/p>\n<h3><span id=\"Disk_yavas_mi_surec_mi_yanlis_calisiyor\">Disk yava\u015f m\u0131, s\u00fcre\u00e7 mi yanl\u0131\u015f \u00e7al\u0131\u015f\u0131yor?<\/span><\/h3>\n<p>Disk kullan\u0131m y\u00fczdesi y\u00fcksek de\u011filken uygulama yine de bekleyebilir. K\u00fc\u00e7\u00fck ve rastgele I\/O i\u015flemleri, sanal disk katman\u0131ndaki kuyruklar veya tek bir dosyada kilitlenme bu durumu a\u00e7\u0131klayabilir. eBPF ile blok I\/O gecikmesini, i\u015flemi ba\u015flatan s\u00fcreci ve okuma-yazma davran\u0131\u015f\u0131n\u0131 birlikte inceleyebilirsiniz.<\/p>\n<p>Bu veriyi dosya i\u00e7eri\u011fiyle kar\u0131\u015ft\u0131rmay\u0131n. eBPF burada \u00e7o\u011funlukla olay\u0131n zaman\u0131n\u0131, s\u00fcrecini ve sistem \u00e7a\u011fr\u0131s\u0131 ba\u011flam\u0131n\u0131 g\u00f6sterir; hassas uygulama verilerini incelemeniz gerekti\u011fi anlam\u0131na gelmez.<\/p>\n<div class=\"aiw-note aiw-note-example\">\n<p class=\"aiw-box-title\">\u00d6rnek senaryo<\/p>\n<p>Varsayal\u0131m ki WooCommerce ma\u011fazan\u0131zda \u00f6deme sayfas\u0131 yo\u011fun saatlerde yava\u015fl\u0131yor, PHP hata g\u00fcnl\u00fc\u011f\u00fcnde belirgin bir hata g\u00f6r\u00fcnm\u00fcyor ve CPU kullan\u0131m\u0131 orta seviyede kal\u0131yor. \u0130lk hipotezinizin &#8220;PHP daha fazla CPU istiyor&#8221; olmas\u0131 gerekmez. eBPF ile PHP-FPM s\u00fcre\u00e7lerinin disk beklemesini ve d\u0131\u015f ba\u011flant\u0131 kurma davran\u0131\u015f\u0131n\u0131 ayr\u0131 ayr\u0131 g\u00f6zlemleyerek sorunu daraltabilirsiniz. Bu, \u00f6l\u00e7\u00fcm yap\u0131lmadan kurulmu\u015f \u00f6rnek bir senaryodur; ger\u00e7ek neden ancak sunucunuzdaki verilerle do\u011frulanabilir.<\/p>\n<\/div>\n<h2><span id=\"Kurulumdan_once_guvenli_gozlem_plani\">Kurulumdan \u00f6nce g\u00fcvenli g\u00f6zlem plan\u0131<\/span><\/h2>\n<p>eBPF ara\u00e7lar\u0131n\u0131n kurulmas\u0131 ile eBPF program\u0131n\u0131n \u00e7ekirde\u011fe ba\u011flanmas\u0131 farkl\u0131 a\u015famalard\u0131r. Kurulum, paket y\u00f6neticisi ve da\u011f\u0131t\u0131m depolar\u0131na ba\u011fl\u0131d\u0131r. G\u00f6zlem s\u0131ras\u0131nda ise yetkiler, \u00e7ekirdek deste\u011fi, semboller ve ara\u00e7 s\u00fcr\u00fcmleri belirleyici olur.<\/p>\n<h3><span id=\"On_kosullari_dogrulayin\">\u00d6n ko\u015fullar\u0131 do\u011frulay\u0131n<\/span><\/h3>\n<p>\u0130lk ad\u0131m, mevcut sistemi de\u011fi\u015ftirmeden \u00e7ekirde\u011fin ve ara\u00e7lar\u0131n durumunu kaydetmektir. A\u015fa\u011f\u0131daki komutlar yaln\u0131zca bilgi toplar:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">uname -r\ncommand -v bpftrace\ncommand -v bpftool\nsudo bpftool feature probe kernel<\/code><\/pre>\n<p><code>bpftool<\/code> bulunmuyorsa komut \u00e7al\u0131\u015fmaz; bu tek ba\u015f\u0131na \u00e7ekirde\u011fin eBPF desteklemedi\u011fini g\u00f6stermez. Da\u011f\u0131t\u0131m\u0131n\u0131z\u0131n uygun paketini kurman\u0131z gerekebilir. Baz\u0131 ara\u00e7lar BCC kitapl\u0131klar\u0131n\u0131, baz\u0131lar\u0131 LLVM\/Clang bile\u015fenlerini kullan\u0131r. Ara\u00e7 s\u00fcr\u00fcmlerini da\u011f\u0131t\u0131m\u0131n\u0131z\u0131n destekledi\u011fi paketlerden se\u00e7in.<\/p>\n<p>\u00dcretim sunucusunda paket kurulumu yapacaksan\u0131z \u00f6nce paket y\u00f6neticisinin de\u011fi\u015fiklik listesini inceleyin, bak\u0131m prosed\u00fcr\u00fcn\u00fcz\u00fc ve geri d\u00f6n\u00fc\u015f plan\u0131n\u0131z\u0131 uygulay\u0131n. Sadece g\u00f6zlem i\u00e7in \u00e7ekirdek g\u00fcncellemek, te\u015fhis edilmemi\u015f bir gecikmeyi \u00e7\u00f6zmekten daha geni\u015f bir de\u011fi\u015fikliktir.<\/p>\n<h3><span id=\"Yetki_ve_guvenlik_sinirlarini_belirleyin\">Yetki ve g\u00fcvenlik s\u0131n\u0131rlar\u0131n\u0131 belirleyin<\/span><\/h3>\n<p>Bir\u00e7ok eBPF g\u00f6zlem komutu root veya \u00f6zel yetenekler gerektirir. Komutu sudo ile \u00e7al\u0131\u015ft\u0131rmak, kullan\u0131c\u0131ya s\u0131n\u0131rs\u0131z ve kal\u0131c\u0131 eri\u015fim vermek anlam\u0131na gelmemelidir. Sadece gerekli y\u00f6neticilerin kullanaca\u011f\u0131 ayr\u0131 bir te\u015fhis prosed\u00fcr\u00fc tan\u0131mlay\u0131n ve \u00e7\u0131kt\u0131larda komut sat\u0131r\u0131, dosya ad\u0131 veya a\u011f adresi gibi hassas bilgilerin bulunabilece\u011fini hesaba kat\u0131n.<\/p>\n<p>\u00dcretim ortam\u0131nda ilk denemeyi k\u0131sa s\u00fcreli ve dar kapsaml\u0131 yap\u0131n. T\u00fcm s\u00fcre\u00e7leri ve t\u00fcm sistem \u00e7a\u011fr\u0131lar\u0131n\u0131 s\u0131n\u0131rs\u0131z toplamak yerine belirli bir PID, komut ad\u0131, port veya zaman aral\u0131\u011f\u0131 kullan\u0131n. \u00c7\u0131kt\u0131y\u0131 ortak kanallara aktarmadan \u00f6nce eri\u015fim izinlerini kontrol edin.<\/p>\n<h3><span id=\"FPM_CLI_ve_kuyruk_sureclerini_ayirin\">FPM, CLI ve kuyruk s\u00fcre\u00e7lerini ay\u0131r\u0131n<\/span><\/h3>\n<p>Web iste\u011fini i\u015fleyen PHP-FPM \u00e7al\u0131\u015fan\u0131 ile cron veya kuyruk t\u00fcketicisi olarak \u00e7al\u0131\u015fan CLI s\u00fcreci ayn\u0131 \u00e7al\u0131\u015fma modeline sahip de\u011fildir. HTTP iste\u011fi yapmayan bir CLI i\u015fi PHP-FPM web i\u015f\u00e7isi t\u00fcketmez. Bu ayr\u0131m, yanl\u0131\u015f s\u00fcreci \u00f6l\u00e7\u00fcp yanl\u0131\u015f sonuca ula\u015fmaman\u0131z i\u00e7in gereklidir.<\/p>\n<p>\u00d6nce s\u00fcre\u00e7leri g\u00f6r\u00fcn:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">ps -eo pid,ppid,comm,args,%cpu,%mem --sort=-%cpu | head -n 20<\/code><\/pre>\n<p>Burada PHP-FPM ana s\u00fcrecinin PID&#8217;si ile \u00e7al\u0131\u015fan i\u015f\u00e7ilerin PID&#8217;lerini, cron komutunu veya kuyruk t\u00fcketicisini ay\u0131r\u0131n. eBPF filtresini m\u00fcmk\u00fcnse tek bir \u00e7al\u0131\u015fan PID&#8217;sine uygulay\u0131n. Ana s\u00fcre\u00e7te g\u00f6r\u00fclen d\u00fc\u015f\u00fck aktivite, i\u015f\u00e7ilerin davran\u0131\u015f\u0131n\u0131 temsil etmeyebilir.<\/p>\n<h2><span id=\"CPU_ve_surec_davranisini_eBPF_ile_inceleme\">CPU ve s\u00fcre\u00e7 davran\u0131\u015f\u0131n\u0131 eBPF ile inceleme<\/span><\/h2>\n<p>CPU belirtisini incelerken \u00f6nce standart \u00f6l\u00e7\u00fcmle zaman aral\u0131\u011f\u0131n\u0131 belirleyin. <code>top<\/code>, <code>pidstat<\/code> veya mevcut izleme sisteminiz hangi PID&#8217;nin y\u00fckseldi\u011fini ve art\u0131\u015f\u0131n ne kadar s\u00fcrd\u00fc\u011f\u00fcn\u00fc g\u00f6stermelidir. eBPF bundan sonra &#8220;bu s\u00fcre\u00e7 hangi \u00e7a\u011fr\u0131 y\u0131\u011f\u0131n\u0131nda \u00f6rnekleniyor?&#8221; sorusunu yan\u0131tlamak i\u00e7in kullan\u0131lmal\u0131d\u0131r.<\/p>\n<h3><span id=\"Dar_kapsamli_profil_ornegi\">Dar kapsaml\u0131 profil \u00f6rne\u011fi<\/span><\/h3>\n<p>A\u015fa\u011f\u0131daki <code>bpftrace<\/code> \u00f6rne\u011fi, PID&#8217;si 1234 olan s\u00fcreci saniyede 49 \u00f6rnekle profiller. PID&#8217;yi kendi te\u015fhisinizde belirledi\u011finiz \u00e7al\u0131\u015fan s\u00fcre\u00e7le de\u011fi\u015ftirin:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo bpftrace -e &#039;profile:hz:49 \/pid == 1234\/ { @[ustack] = count(); }&#039;<\/code><\/pre>\n<p>Komut, siz durdurana kadar \u00f6rnekleri toplar; k\u0131sa bir g\u00f6zlem penceresi i\u00e7in <code>Ctrl+C<\/code> ile sonland\u0131rabilirsiniz. Kullan\u0131c\u0131 alan\u0131 \u00e7a\u011fr\u0131 y\u0131\u011f\u0131nlar\u0131n\u0131n anlaml\u0131 g\u00f6r\u00fcnmesi i\u00e7in ilgili ikili dosyada sembol bilgisi veya uygun debug sembolleri gerekebilir. Sembol yoksa adresler ya da eksik adlar g\u00f6rebilirsiniz.<\/p>\n<p>\u00c7\u0131kt\u0131da tek ba\u015f\u0131na en y\u00fcksek sat\u0131r\u0131 k\u00f6k neden olarak kabul etmeyin. Ayn\u0131 g\u00f6zlemi uygulama iste\u011fi oran\u0131, CPU bekleme durumu ve ilgili da\u011f\u0131t\u0131m zaman\u0131 ile kar\u015f\u0131la\u015ft\u0131r\u0131n. Profil, yo\u011fun kod yolunu i\u015faret eder; i\u015f kural\u0131n\u0131n hatal\u0131 oldu\u011funu kan\u0131tlamaz.<\/p>\n<h3><span id=\"Sistem_cagri_yogunlugunu_gorun\">Sistem \u00e7a\u011fr\u0131 yo\u011funlu\u011funu g\u00f6r\u00fcn<\/span><\/h3>\n<p>Bir s\u00fcre\u00e7 \u00e7ok say\u0131da dosya a\u00e7\u0131yor, zamanlay\u0131c\u0131 \u00e7a\u011fr\u0131s\u0131 yap\u0131yor veya beklenenden fazla sistem \u00e7a\u011fr\u0131s\u0131 \u00fcretiyor olabilir. A\u015fa\u011f\u0131daki \u00f6rnek, \u00e7al\u0131\u015fan komut ad\u0131na g\u00f6re <code>openat<\/code> \u00e7a\u011fr\u0131lar\u0131n\u0131 sayar:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo bpftrace -e &#039;tracepoint:syscalls:sys_enter_openat { @[comm] = count(); }&#039;<\/code><\/pre>\n<p>Bu \u00f6rnekte PID filtresi yoktur; bu nedenle k\u0131sa s\u00fcreli te\u015fhis ve d\u00fc\u015f\u00fck yo\u011funluklu sunucularda kullan\u0131n. \u00dcretim sisteminde tek bir s\u00fcre\u00e7le s\u0131n\u0131rland\u0131rmak daha g\u00fcvenlidir:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo bpftrace -e &#039;tracepoint:syscalls:sys_enter_openat \/pid == 1234\/ { @[comm] = count(); }&#039;<\/code><\/pre>\n<p>Y\u00fcksek \u00e7a\u011fr\u0131 say\u0131s\u0131 her zaman performans sorunu de\u011fildir. Uygulaman\u0131n beklenen \u00e7al\u0131\u015fma bi\u00e7imi \u00e7ok say\u0131da k\u00fc\u00e7\u00fck dosya eri\u015fimi gerektirebilir. \u015e\u00fcpheli sonucu sistem \u00e7a\u011fr\u0131s\u0131 s\u00fcresi ve uygulama davran\u0131\u015f\u0131yla do\u011frulay\u0131n.<\/p>\n<div class=\"aiw-note aiw-note-tip\">\n<p class=\"aiw-box-title\">\u0130pucu<\/p>\n<p>eBPF Linux sunucu izleme \u00e7al\u0131\u015fmas\u0131n\u0131 s\u00fcrekli \u00fcretim metri\u011fi gibi tasarlamadan \u00f6nce te\u015fhis arac\u0131 olarak ba\u015flat\u0131n. Kal\u0131c\u0131 alarm i\u00e7in \u00f6rnekleme maliyeti, veri saklama s\u00fcresi, yetki modeli ve alarm e\u015fi\u011fini ayr\u0131ca tasarlay\u0131n. Merkezi sunucu izleme ve alarm mimarisi bu s\u00fcrekli i\u015fletim katman\u0131n\u0131 planlamak i\u00e7in ayr\u0131 bir konudur.<\/p>\n<\/div>\n<h2><span id=\"Ag_gecikmesini_katmanlarina_ayirma\">A\u011f gecikmesini katmanlar\u0131na ay\u0131rma<\/span><\/h2>\n<p>A\u011f sorunu bildirildi\u011finde \u00f6nce hangi ba\u011flant\u0131n\u0131n gecikti\u011fini belirleyin. Tek bir sunucuda ayn\u0131 anda istemci istekleri, veritaban\u0131 ba\u011flant\u0131lar\u0131, DNS sorgular\u0131 ve d\u0131\u015f API \u00e7a\u011fr\u0131lar\u0131 bulunabilir. T\u00fcm TCP olaylar\u0131n\u0131 toplamak yerine ba\u011flant\u0131 kuran s\u00fcreci ve hedef portu daralt\u0131n.<\/p>\n<h3><span id=\"TCP_baglanti_girisimlerini_izleme\">TCP ba\u011flant\u0131 giri\u015fimlerini izleme<\/span><\/h3>\n<p>BCC paketi kuruluysa <code>tcpconnect<\/code> arac\u0131 yeni TCP ba\u011flant\u0131lar\u0131n\u0131 \u00f6zetlemek i\u00e7in kullan\u0131labilir. \u00d6rne\u011fin PID 1234 i\u00e7in:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo tcpconnect -p 1234<\/code><\/pre>\n<p>Bu komutun s\u00f6zdizimi BCC s\u00fcr\u00fcm\u00fcne g\u00f6re k\u00fc\u00e7\u00fck farkl\u0131l\u0131klar g\u00f6sterebilir; \u00e7al\u0131\u015ft\u0131rmadan \u00f6nce <code>tcpconnect --help<\/code> \u00e7\u0131kt\u0131s\u0131n\u0131 kontrol edin. Ara\u00e7 ba\u011flant\u0131 giri\u015fimini g\u00f6sterebilir, fakat uzak servisin uygulama d\u00fczeyinde yan\u0131t verdi\u011fini kan\u0131tlamaz.<\/p>\n<p>BCC yoksa ayn\u0131 soruyu bpftrace ile daha d\u00fc\u015f\u00fck ayr\u0131nt\u0131yla inceleyebilirsiniz:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo bpftrace -e &#039;tracepoint:syscalls:sys_enter_connect \/pid == 1234\/ { @[comm] = count(); }&#039;<\/code><\/pre>\n<p>Bu komut ba\u011flant\u0131 sistemi \u00e7a\u011fr\u0131lar\u0131n\u0131n say\u0131s\u0131n\u0131 verir; hedef adresi ve gecikme s\u00fcresini tek ba\u015f\u0131na a\u00e7\u0131klamaz. Ama\u00e7, k\u0131sa s\u00fcrede ola\u011fand\u0131\u015f\u0131 ba\u011flant\u0131 \u00fcretimi olup olmad\u0131\u011f\u0131n\u0131 g\u00f6rmektir.<\/p>\n<h3><span id=\"Yeniden_iletim_ve_ag_kaybini_yorumlayin\">Yeniden iletim ve a\u011f kayb\u0131n\u0131 yorumlay\u0131n<\/span><\/h3>\n<p>TCP yeniden iletimleri, paket kayb\u0131 veya a\u011f yolundaki yo\u011funluk ihtimalini g\u00fc\u00e7lendirebilir. Ancak yeniden iletim tek ba\u015f\u0131na uzak sunucunun yava\u015f oldu\u011funu g\u00f6stermez; yerel a\u011f kart\u0131, sanal a\u011f, g\u00fcvenlik duvar\u0131 ve hedef sistem birlikte de\u011ferlendirilmelidir.<\/p>\n<p>Bu a\u015famada eBPF \u00e7\u0131kt\u0131s\u0131n\u0131 <code>ss -s<\/code>, ba\u011flant\u0131 durumu, uygulama zaman a\u015f\u0131m\u0131 ve d\u0131\u015f izleme verisiyle kar\u015f\u0131la\u015ft\u0131r\u0131n. Bir portta bekleyen \u00e7ok say\u0131da ba\u011flant\u0131 g\u00f6r\u00fcyorsan\u0131z hemen \u00e7ekirdek veya a\u011f ayar\u0131 de\u011fi\u015ftirmeyin. \u00d6nce ba\u011flant\u0131lar\u0131n hangi s\u00fcre\u00e7ten \u00e7\u0131kt\u0131\u011f\u0131n\u0131 ve bunun beklenen trafikle uyumlu olup olmad\u0131\u011f\u0131n\u0131 do\u011frulay\u0131n.<\/p>\n<p>Web performans\u0131n\u0131 incelerken a\u011f \u00f6l\u00e7\u00fcm\u00fcn\u00fc taray\u0131c\u0131 ve uygulama s\u00fcreleriyle birle\u015ftirmek gerekir. Sunucu loglar\u0131yla Core Web Vitals iyile\u015ftirme \u00e7al\u0131\u015fmas\u0131, eBPF g\u00f6zlemini kullan\u0131c\u0131 taraf\u0131ndaki alg\u0131lanan performansla ili\u015fkilendirmenize yard\u0131mc\u0131 olabilir; eBPF tek ba\u015f\u0131na taray\u0131c\u0131 metriklerinin yerine ge\u00e7mez.<\/p>\n<h2><span id=\"Disk_erisimi_ve_IO_beklemelerini_ayirma\">Disk eri\u015fimi ve I\/O beklemelerini ay\u0131rma<\/span><\/h2>\n<p>Disk gecikmesinde iki soruyu ay\u0131r\u0131n: Depolama katman\u0131 ger\u00e7ekten ge\u00e7 mi yan\u0131tl\u0131yor, yoksa uygulama \u00e7ok fazla I\/O iste\u011fi mi \u00fcretiyor? <code>iostat<\/code> veya benzeri ara\u00e7larla genel g\u00f6r\u00fcn\u00fcm\u00fc al\u0131n; ard\u0131ndan eBPF ile s\u00fcre\u00e7 ve gecikme da\u011f\u0131l\u0131m\u0131n\u0131 daralt\u0131n.<\/p>\n<h3><span id=\"Blok_IO_gecikmesini_olcme\">Blok I\/O gecikmesini \u00f6l\u00e7me<\/span><\/h3>\n<p>BCC ara\u00e7lar\u0131 kuruluysa <code>biolatency<\/code>, blok ayg\u0131t\u0131 i\u015flemlerinin gecikme da\u011f\u0131l\u0131m\u0131n\u0131 g\u00f6rmek i\u00e7in kullan\u0131labilir:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo biolatency 1 10<\/code><\/pre>\n<p>Bu \u00f6rnekte arac\u0131n s\u00fcr\u00fcm\u00fcne ba\u011fl\u0131 olarak bir saniyelik aral\u0131klarla on \u00e7\u0131kt\u0131 al\u0131nmas\u0131 beklenir. Desteklenen se\u00e7enekleri kendi sisteminizde <code>biolatency --help<\/code> ile do\u011frulay\u0131n. \u00c7\u0131kt\u0131y\u0131 disk cihaz\u0131, sanal depolama katman\u0131 ve ayn\u0131 zamandaki uygulama istek say\u0131s\u0131yla kar\u015f\u0131la\u015ft\u0131r\u0131n.<\/p>\n<p>Belirli bir s\u00fcrecin dosya eri\u015fimini izlemek i\u00e7in geni\u015f bir sistem \u00e7a\u011fr\u0131s\u0131 yakalama komutu kullanabilirsiniz:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo bpftrace -e &#039;tracepoint:syscalls:sys_enter_read \/pid == 1234\/ { @[comm] = count(); }&#039;<\/code><\/pre>\n<p>Bu \u00f6rnek yaln\u0131zca <code>read<\/code> \u00e7a\u011fr\u0131lar\u0131n\u0131n say\u0131s\u0131n\u0131 g\u00f6sterir; okuma i\u015fleminin ne kadar bekledi\u011fini g\u00f6stermez. Say\u0131 y\u00fcksek diye do\u011frudan disk ar\u0131zas\u0131 sonucuna varmay\u0131n. Uygulama \u00f6nbelle\u011fi, veritaban\u0131 sorgu plan\u0131 veya dosya eri\u015fim paterni de ayn\u0131 belirtiyi \u00fcretebilir.<\/p>\n<h3><span id=\"Veri_degisikliginden_once_siniri_koruyun\">Veri de\u011fi\u015fikli\u011finden \u00f6nce s\u0131n\u0131r\u0131 koruyun<\/span><\/h3>\n<p>Disk sorunu \u015f\u00fcphesiyle dosya silmek, \u00f6nbellek temizlemek, veritaban\u0131 ayar\u0131 de\u011fi\u015ftirmek veya I\/O zamanlay\u0131c\u0131s\u0131n\u0131 de\u011fi\u015ftirmek te\u015fhis ad\u0131m\u0131 de\u011fildir; sistem davran\u0131\u015f\u0131n\u0131 de\u011fi\u015ftirir. \u00d6nce mevcut yap\u0131land\u0131rmay\u0131, disk sa\u011fl\u0131\u011f\u0131 bilgisini ve geri d\u00f6n\u00fc\u015f plan\u0131n\u0131 kaydedin. Veri de\u011fi\u015ftiren ad\u0131m gerekiyorsa yede\u011fin g\u00fcncel oldu\u011funu ve geri y\u00fckleme yolunun test edildi\u011fini do\u011frulay\u0131n.<\/p>\n<div class=\"aiw-note aiw-note-warning\">\n<p class=\"aiw-box-title\">Dikkat<\/p>\n<p>eBPF programlar\u0131n\u0131n \u00e7ekirdek do\u011frulay\u0131c\u0131s\u0131ndan ge\u00e7mesi g\u00fcvenli bir \u00e7al\u0131\u015fma modeli sa\u011flar, fakat her g\u00f6zlem komutu \u00fccretsiz de\u011fildir. \u00c7ok geni\u015f filtreler, y\u00fcksek olay oran\u0131 ve uzun s\u00fcreli stack toplama CPU, bellek veya \u00e7\u0131kt\u0131 depolama maliyeti olu\u015fturabilir. \u00d6nce k\u0131sa s\u00fcre, tek PID veya tek olay t\u00fcr\u00fc kullan\u0131n; \u00f6l\u00e7\u00fcm maliyetini izleyin.<\/p>\n<\/div>\n<h2><span id=\"Surec_dosya_ve_cekirdek_olaylarini_birlikte_dogrulama\">S\u00fcre\u00e7, dosya ve \u00e7ekirdek olaylar\u0131n\u0131 birlikte do\u011frulama<\/span><\/h2>\n<p>Tek bir ara\u00e7 nadiren k\u00f6k nedeni kan\u0131tlar. \u00d6rne\u011fin PHP-FPM bekliyorsa bunun nedeni disk, veritaban\u0131 soketi, dosya kilidi veya d\u0131\u015f API olabilir. eBPF size olay zamanlar\u0131n\u0131 verir; s\u00fcre\u00e7 listesi, uygulama logu, a\u011f ba\u011flant\u0131s\u0131 ve depolama verisi bu zaman \u00e7izelgesini anlamland\u0131r\u0131r.<\/p>\n<h3><span id=\"Bir_teshis_akisi_kurun\">Bir te\u015fhis ak\u0131\u015f\u0131 kurun<\/span><\/h3>\n<ol>\n<li><strong>Belirtiyi zamanlay\u0131n:<\/strong> Sorunun ba\u015flad\u0131\u011f\u0131 ve bitti\u011fi dakikalar\u0131, etkilenen servisleri ve trafik de\u011fi\u015fimini kaydedin.<\/li>\n<li><strong>S\u00fcreci belirleyin:<\/strong> FPM \u00e7al\u0131\u015fan\u0131, CLI cron i\u015fi, kuyruk t\u00fcketicisi ve veritaban\u0131 s\u00fcrecini birbirine kar\u0131\u015ft\u0131rmay\u0131n.<\/li>\n<li><strong>Tek hipotez se\u00e7in:<\/strong> \u00d6rne\u011fin &#8220;PID 1234, disk okumas\u0131nda bekliyor&#8221; gibi s\u0131n\u0131rlar\u0131 belli bir soru yaz\u0131n.<\/li>\n<li><strong>En dar eBPF \u00f6l\u00e7\u00fcm\u00fcn\u00fc \u00e7al\u0131\u015ft\u0131r\u0131n:<\/strong> PID, olay t\u00fcr\u00fc ve k\u0131sa zaman aral\u0131\u011f\u0131 kullan\u0131n.<\/li>\n<li><strong>Ba\u011f\u0131ms\u0131z veriyle kar\u015f\u0131la\u015ft\u0131r\u0131n:<\/strong> Uygulama s\u00fcresi, sistem metri\u011fi, a\u011f durumu ve ilgili log sat\u0131rlar\u0131n\u0131 ayn\u0131 zaman penceresinde inceleyin.<\/li>\n<li><strong>Dar d\u00fczeltme uygulay\u0131n:<\/strong> Ayar de\u011fi\u015fikli\u011fi gerekiyorsa yaln\u0131zca do\u011frulad\u0131\u011f\u0131n\u0131z nedene dokunun ve mevcut yap\u0131land\u0131rmay\u0131 yedekleyin.<\/li>\n<li><strong>Tekrar \u00f6l\u00e7\u00fcn:<\/strong> Ayn\u0131 belirti ortadan kalkt\u0131 m\u0131, yoksa yaln\u0131zca ba\u015fka bir katmana m\u0131 ta\u015f\u0131nd\u0131 kontrol edin.<\/li>\n<\/ol>\n<p>Bu ak\u0131\u015fta g\u00f6zlem ile d\u00fczeltme aras\u0131ndaki s\u0131n\u0131r korunur. \u00d6rne\u011fin bir s\u00fcrecin \u00e7ok say\u0131da dosya a\u00e7t\u0131\u011f\u0131n\u0131 g\u00f6rmek, hemen dosya tan\u0131t\u0131c\u0131 limitini art\u0131rmay\u0131 gerektirmez. \u00d6nce uygulaman\u0131n beklenen davran\u0131\u015f\u0131n\u0131 ve hata ko\u015fulunu do\u011frulay\u0131n.<\/p>\n<h3><span id=\"Kernel_seviyesindeki_belirtilerde_dikkat\">Kernel seviyesindeki belirtilerde dikkat<\/span><\/h3>\n<p>\u00c7ekirdek hatas\u0131, kilitlenme veya beklenmeyen yeniden ba\u015flatma gibi olaylarda eBPF tek ba\u015f\u0131na kurtarma arac\u0131 de\u011fildir. Kal\u0131c\u0131 loglar, konsol \u00e7\u0131kt\u0131s\u0131, watchdog ve \u00e7ekirdek d\u00f6k\u00fcmleri ayr\u0131ca incelenmelidir. Sistem daha \u00f6nce kernel panic ya\u015fad\u0131ysa <a href=\"https:\/\/www.dchost.com\/blog\/linux-kernel-panic-cozumu-kok-neden-ve-kurtarma\/\">kernel panic k\u00f6k neden analizi<\/a> i\u00e7in a\u00e7\u0131l\u0131\u015f g\u00fcnl\u00fcklerini ve donan\u0131m\/sanal altyap\u0131 kay\u0131tlar\u0131n\u0131 da birlikte de\u011ferlendirin.<\/p>\n<p>eBPF ile olay yakalamak, ge\u00e7mi\u015fte olu\u015fmu\u015f ve kaydedilmemi\u015f bir ar\u0131zay\u0131 geriye d\u00f6n\u00fck olarak \u00fcretmez. \u00d6l\u00e7\u00fcm\u00fc belirti yeniden olu\u015furken planlay\u0131n; ancak g\u00fcvenlik, performans ve veri gizlili\u011fi s\u0131n\u0131rlar\u0131n\u0131 a\u015fmadan uygulay\u0131n.<\/p>\n<h2><span id=\"Arac_secimi_bpftrace_BCC_ve_hazir_gozlem_araclari\">Ara\u00e7 se\u00e7imi: bpftrace, BCC ve haz\u0131r g\u00f6zlem ara\u00e7lar\u0131<\/span><\/h2>\n<p><code>bpftrace<\/code>, k\u0131sa ve tek ama\u00e7l\u0131 g\u00f6zlem komutlar\u0131 i\u00e7in pratik bir ba\u015flang\u0131\u00e7t\u0131r. Sistem \u00e7a\u011fr\u0131s\u0131, tracepoint ve profil \u00f6rnekleriyle hipotezi h\u0131zl\u0131ca test edebilirsiniz. Bunun kar\u015f\u0131l\u0131\u011f\u0131nda s\u00f6zdizimi, olay adlar\u0131 ve \u00e7ekirdek s\u00fcr\u00fcm\u00fc aras\u0131ndaki uyumlulu\u011fu kontrol etmeniz gerekir.<\/p>\n<p>BCC, a\u011f, disk ve s\u00fcre\u00e7 davran\u0131\u015f\u0131 i\u00e7in haz\u0131rlanm\u0131\u015f ara\u00e7lar sunar. <code>tcpconnect<\/code>, <code>biolatency<\/code> ve benzeri ara\u00e7lar, her olay\u0131 s\u0131f\u0131rdan yazmadan \u00f6l\u00e7\u00fcm yapman\u0131z\u0131 sa\u011flar. Da\u011f\u0131t\u0131m paketinin BCC s\u00fcr\u00fcm\u00fc ile \u00e7ekirdek ve Python ba\u011f\u0131ml\u0131l\u0131klar\u0131 uyumlu olmayabilir; her komutu \u00f6nce yard\u0131m \u00e7\u0131kt\u0131s\u0131yla do\u011frulay\u0131n.<\/p>\n<p><code>bpftool<\/code> ise haritalar\u0131, programlar\u0131 ve \u00e7ekirdek \u00f6zelliklerini incelemek i\u00e7in daha d\u00fc\u015f\u00fck seviyeli bir y\u00f6netim arac\u0131d\u0131r. Geli\u015ftirici veya sunucu y\u00f6neticisi olarak eBPF program\u0131n\u0131n ger\u00e7ekten y\u00fcklendi\u011fini do\u011frulaman\u0131z gerekti\u011finde kullan\u0131\u015fl\u0131d\u0131r. Kal\u0131c\u0131 g\u00f6zlem sistemi kuracaksan\u0131z veri modeli, \u00f6rnekleme, yetki ve y\u00fckseltme prosed\u00fcr\u00fcn\u00fc ayr\u0131ca tasarlay\u0131n.<\/p>\n<h2><span id=\"Sik_Sorulan_Sorular\">S\u0131k Sorulan Sorular<\/span><\/h2>\n<h3><span id=\"eBPF_kullanmak_icin_uygulamanin_kodunu_degistirmek_gerekir_mi\">eBPF kullanmak i\u00e7in uygulaman\u0131n kodunu de\u011fi\u015ftirmek gerekir mi?<\/span><\/h3>\n<p>Temel g\u00f6zlem komutlar\u0131 i\u00e7in \u00e7o\u011fu zaman gerekmez. \u00c7ekirdek olaylar\u0131n\u0131 ve s\u00fcre\u00e7 davran\u0131\u015f\u0131n\u0131 d\u0131\u015far\u0131dan izleyebilirsiniz. Uygulama i\u00e7i \u00f6zel i\u015f ak\u0131\u015flar\u0131n\u0131 anlamak i\u00e7in ek sembol, enstr\u00fcmantasyon veya uygulama metri\u011fi gerekebilir.<\/p>\n<h3><span id=\"eBPF_uretim_sunucusunu_yavaslatir_mi\">eBPF \u00fcretim sunucusunu yava\u015flat\u0131r m\u0131?<\/span><\/h3>\n<p>Etkisi kullan\u0131lan program\u0131n olay yo\u011funlu\u011funa, filtrelerine ve toplad\u0131\u011f\u0131 veriye ba\u011fl\u0131d\u0131r. Tek PID ve k\u0131sa s\u00fcreli bir trace, geni\u015f kapsaml\u0131 s\u00fcrekli toplamadan daha kontroll\u00fcd\u00fcr. Yine de \u00f6l\u00e7\u00fcm s\u0131ras\u0131nda CPU, bellek ve \u00e7\u0131kt\u0131 hacmini izleyin.<\/p>\n<h3><span id=\"eBPF_loglarin_yerini_alir_mi\">eBPF loglar\u0131n yerini al\u0131r m\u0131?<\/span><\/h3>\n<p>Hay\u0131r. Loglar i\u015f kural\u0131, hata mesaj\u0131 ve i\u015flem ba\u011flam\u0131 sunar; eBPF \u00e7ekirdek ve s\u00fcre\u00e7 olaylar\u0131n\u0131n zamanlamas\u0131n\u0131 tamamlar. \u0130ki veri kayna\u011f\u0131n\u0131 ayn\u0131 zaman aral\u0131\u011f\u0131nda kar\u015f\u0131la\u015ft\u0131rmak daha g\u00fcvenilir te\u015fhis sa\u011flar.<\/p>\n<h3><span id=\"Her_Linux_dagitiminda_ayni_komutlar_calisir_mi\">Her Linux da\u011f\u0131t\u0131m\u0131nda ayn\u0131 komutlar \u00e7al\u0131\u015f\u0131r m\u0131?<\/span><\/h3>\n<p>Hay\u0131r. \u00c7ekirdek s\u00fcr\u00fcm\u00fc, BCC veya bpftrace paketi, tracepoint adlar\u0131 ve yetki politikalar\u0131 farkl\u0131 olabilir. Komutu \u00fcretimden \u00f6nce ayn\u0131 da\u011f\u0131t\u0131m ve \u00e7ekirdek ailesine sahip bir test ortam\u0131nda do\u011frulay\u0131n.<\/p>\n<h2><span id=\"Uygulanabilir_son_kontrol_listesi\">Uygulanabilir son kontrol listesi<\/span><\/h2>\n<ul>\n<li>Belirtiyi CPU, a\u011f, disk veya s\u00fcre\u00e7 davran\u0131\u015f\u0131 olarak s\u0131n\u0131rland\u0131r\u0131n.<\/li>\n<li>\u00c7ekirdek s\u00fcr\u00fcm\u00fcn\u00fc, ara\u00e7lar\u0131n kurulu oldu\u011funu ve gerekli yetkileri do\u011frulay\u0131n.<\/li>\n<li>PHP-FPM, CLI cron ve kuyruk s\u00fcre\u00e7lerinin PID&#8217;lerini ay\u0131r\u0131n.<\/li>\n<li>\u0130lk \u00f6l\u00e7\u00fcm\u00fc k\u0131sa s\u00fcreli, tek PID veya tek olay t\u00fcr\u00fcyle yap\u0131n.<\/li>\n<li>eBPF \u00e7\u0131kt\u0131s\u0131n\u0131 log, standart sistem metri\u011fi ve uygulama s\u00fcresiyle kar\u015f\u0131la\u015ft\u0131r\u0131n.<\/li>\n<li>Yap\u0131land\u0131rma veya veri de\u011fi\u015ftiren ad\u0131mdan \u00f6nce yedek ve geri d\u00f6n\u00fc\u015f plan\u0131n\u0131 kontrol edin.<\/li>\n<li>D\u00fczeltmeden sonra ayn\u0131 \u00f6l\u00e7\u00fcmle sonucu do\u011frulay\u0131n ve ge\u00e7ici g\u00f6zlem program\u0131n\u0131 sonland\u0131r\u0131n.<\/li>\n<\/ul>\n<p>Bir sonraki ad\u0131m, tekrar eden belirtiniz i\u00e7in tek bir te\u015fhis hipotezi yaz\u0131p uygun arac\u0131 se\u00e7mektir. \u00d6rne\u011fin CPU y\u00fckselmesi i\u00e7in PID s\u0131n\u0131rl\u0131 profil, a\u011f gecikmesi i\u00e7in ba\u011flant\u0131 g\u00f6zlemi, disk beklemesi i\u00e7in I\/O gecikme \u00f6l\u00e7\u00fcm\u00fcyle ba\u015flay\u0131n. G\u00f6zlem kapsam\u0131 darald\u0131k\u00e7a eBPF Linux sunucu izleme, belirsiz bir &#8220;sunucu yava\u015f&#8221; \u015fik\u00e2yetini do\u011frulanabilir bir zaman \u00e7izelgesine d\u00f6n\u00fc\u015ft\u00fcr\u00fcr.<\/p>\n<p><em>Emre<\/em><\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>eBPF ile Linux sunucularda CPU, a\u011f gecikmesi, disk eri\u015fimi ve s\u00fcre\u00e7 davran\u0131\u015f\u0131n\u0131 g\u00fcvenli bi\u00e7imde g\u00f6zlemleyerek k\u00f6k neden analizi yap\u0131n.<\/p>\n","protected":false},"author":4,"featured_media":5776,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[617,616,613,614,574,615],"class_list":["post-5780","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-teknoloji","tag-bcc","tag-bpftrace","tag-ebpf","tag-linux-sunucu-izleme","tag-sistem-yonetimi","tag-sunucu-sorun-teshisi"],"_links":{"self":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts\/5780","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/comments?post=5780"}],"version-history":[{"count":1,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts\/5780\/revisions"}],"predecessor-version":[{"id":5782,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts\/5780\/revisions\/5782"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/media\/5776"}],"wp:attachment":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/media?parent=5780"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/categories?post=5780"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/tags?post=5780"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}