rbspy VS parca-agent

We used rbspy to generate the flamegraph:

You could use rbspy to profile the EventMachine process as it's doing the workload, and try to see there where most of the time is being spent.

Not sure what your issue is and you got some of this info from strace, but FYI rbspy can also help profile where a running Ruby process is spending its time: https://rbspy.github.io/. I think it's a little more helpful than strace in that it should bring it back to Ruby code rather than just showing the raw syscalls.

Even the most general profiler tool will show you each statement's accumulated time. These are called statistical profilers and give you a panoramic view of what the test is doing. An example of such a profiler is rbspy:

As a result, you need to craft a specific routine for each interpreter runtime (in some cases, each version of that runtime) to obtain symbol information. Educated eyes might have already noticed, it's not an easy undertaking considering the sheer amount of interpreted languages out there. For example, a very well known Ruby profiler, rbspy, generates code for reading internal structs of the Ruby runtime for each version.

For production, it depends on what the process is built with. There are possibly better tracing tools than just strace. For example Java has JMX, Go has pprof. There's also things like rbspy for Ruby.

I was a bit surprised to find out that the tool used to generate the flamegraph for Ruby (rbspy [1]) is written in Rust. lol

[1] https://github.com/rbspy/rbspy

Maybe https://github.com/rbspy/rbspy would allow you to profile the running ruby process handling web sockets?

c function is not very helpful to find the performance problem, so we dug deeper.

If that's true, you should probably update the docs. Everything I could find implied dotnet, jvm, python were still unsupported. For example, the roadmap section of the readme mentions most of these but nothing mentions dotnet. However I did find your tickets and a demo being merged in which makes it seem maybe supported?

Ticket: https://github.com/parca-dev/parca-agent/issues/161

Demo: https://github.com/parca-dev/parca-demo/pull/18

Couldn't see any advantages to this over https://github.com/parca-dev/parca-agent. Which uses eBPF so it can be used with non-instrumented apps and code paths.

The pervasive lack of frame pointers is the reason why we've developed a custom format derived from DWARF unwind information thanks to some insights: DWARF unwind information is incredible flexible, it supports many arches and allows restoring any arbitrary register. But we only need 3: the frame pointer, the stack pointer, and in non-x86 the return address.

In addition, this encoding doesn't use that many bytes, but unfortunately reading and parsing that information is quite expensive.

For that reason I've developed a new unwinder that uses custom unwind information derived from DWARF (https://www.polarsignals.com/blog/posts/2022/11/29/profiling..., previously discussed in https://news.ycombinator.com/item?id=33788794) that runs in BPF. This new compact representation can be binary searched easily and each unwind row has a size of 16 bytes. I are currently working on reducing it down to ~10 bytes.

All the code is fully OSS (Apache 2.0 for userspace and GPL for BPF), and part of the Parca project (https://github.com/parca-dev/parca-agent).

We've also given some talks in FOSDEM going deeper into how we made it scale for many big processes.

I find this surprising! Was this for off the shelf applications or some custom binaries?

As mentioned above, we see DWARF expressions such as `DW_CFA_def_cfa_expression` on the regular. See the "Test Plan" section and commit messages of the PR that introduced support for this particular opcode [0]

[0]: https://github.com/parca-dev/parca-agent/pull/1058

Let's see an example perf map file for NodeJS. The runtimes out there output this file with more or less the same format, more or less!

The good news is we got you covered. If you are using Parca Agent, we already do the heavy lifting for you to symbolize captured stack traces. And we keep extending our support for the different languages and runtimes.