←back to thread

How Netflix Accurately Attributes eBPF Flow Logs

(netflixtechblog.com)
160 points simplesort | 1 comments | 08 Apr 25 18:21 UTC | HN request time: 0s | source
Show context
slt2021 ◴[08 Apr 25 22:11 UTC] No.43626982[source]▶
Question to the Netflix folks: I saw a lot of in-house developed tools being quoted, do you guys have service mesh like linkerd ?

Have you guys evaluated vendors like Kentik?

I would love to get more insight into what do you guys actually do with flow logs? for example if I store 1 TB of flow logs, what value can I actually derive from them that justify the cost of collection, processing, and storage.

replies(2): >>43627581 #>>43628881 #
madduci ◴[09 Apr 25 04:29 UTC] No.43628881[source]▶
Exactly my thought. Maybe it's the "not invented here" syndrome?

We use Istio as Service Mesh and get the same result, using the same architecture as shown in the blog post (especially the part where each workload has a sidecar container running Flow).

replies(1): >>43629391 #
1. moqizhengz ◴[09 Apr 25 06:16 UTC] No.43629391[source]▶
From my experience in big tech, another reason is that OPS guys just cant resist the concept of eBPF, go all the way done trying to figure out what this beautiful technology can do and forgot what thery really wanted at the begining.