Nahida: In-Band Distributed Tracing with eBPF

TL;DR

Nahida is a non-invasive, eBPF-based distributed tracing system that accurately tracks requests in microservices environments with minimal overhead, improving fault diagnosis without intrusive instrumentation.

Contribution

Introduces Nahida, a novel eBPF-based tracing system that overcomes limitations of existing methods by providing accurate, non-invasive, kernel-level request tracking across diverse microservices.

Findings

Tracks over 92% of requests with stable accuracy

Handles multi-threaded applications effectively

Introduces negligible overhead of 1.55%-2.1% in latency

Abstract

Microservices are commonly used in modern cloud-native applications to achieve agility. However, the complexity of service dependencies in large-scale microservices systems can lead to anomaly propagation, making fault troubleshooting a challenge. To address this issue, distributed tracing systems have been proposed to trace complete request execution paths, enabling developers to troubleshoot anomalous services. However, existing distributed tracing systems have limitations such as invasive instrumentation, trace loss, or inaccurate trace correlation. To overcome these limitations, we propose a new tracing system based on eBPF (extended Berkeley Packet Filter), named Nahida, that can track complete requests in the kernel without intrusion, regardless of programming language or implementation. Our evaluation results show that Nahida can track over 92% of requests with stable accuracy, even under the high concurrency of user requests, while the state-of-the-art non-invasive approaches can not track any of the requests. Importantly, Nahida can track requests served by a multi-threaded application that none of the existing invasive tracing systems can handle by instrumenting tracing codes into libraries. Moreover, the overhead introduced by Nahida is negligible, increasing service latency by only 1.55%-2.1%. Overall, Nahida provides an effective and non-invasive solution for distributed tracing.