I understand that you can do this, but I'm not sure i understand the rationale. I can't imagine that this is a hot enough path that this makes sense from a performance perspective, so why? What's the benefit?
Naively the thing this is replacing sounds like a much better solution than the replacement is.
> We replaced the listener with an eBPF program that watches port 8125 at the traffic control layer of every interface, and a JavaScript decoder that turns the lines into Prometheus families.
this is insane! Why on earth would one to replace a short, simple, highly debugable program with this crazy combination. Why would you trade a simple socket(2) call which shows up in ss, netstat, strace etc.. with something that opaque? Especially given the bandwidth is minuscule and the destination is already localhost.
Naively the thing this is replacing sounds like a much better solution than the replacement is.
this is insane! Why on earth would one to replace a short, simple, highly debugable program with this crazy combination. Why would you trade a simple socket(2) call which shows up in ss, netstat, strace etc.. with something that opaque? Especially given the bandwidth is minuscule and the destination is already localhost.