Christoph Lutz
@christophlutz.bsky.social
📤 138
📥 82
📝 187
Those who don't jump will never fly.
https://www.0xChris.dev
I felt like taking a closer look at this new datapatch feature and ended up making some interesting discoveries 🙂
t.ly/Tufob
add a skeleton here at some point
7 days ago
1
7
1
rovarma.com/articles/fro...
loading . . .
From profiling to kernel patch: the journey to an eBPF performance fix | Ritesh Oedayrajsingh Varma
A story about how an innocent profiling session led to a change to the Linux kernel that makes eBPF map-in-map updates much faster.
https://rovarma.com/articles/from-profiling-to-kernel-patch-the-journey-to-an-ebpf-performance-fix/
about 1 month ago
0
0
0
Woot! By a happy twist of fate, a ticket for the 39th Chaos Communication Congress came may way ... 😀 See you in Hamburg!
@ccc.de
Thanks
@krischan.bsky.social
!
about 1 month ago
1
2
0
justoffbyone.com/posts/math-o...
loading . . .
The Math of Why You Can't Focus at Work
Interruptions, recovery time, and task size: three numbers that determine if you'll get real work done. Interactive visualizations show the math behind bad days.
https://justoffbyone.com/posts/math-of-why-you-cant-focus-at-work/
about 2 months ago
1
0
0
#POUG2026
dress code 😜
www.galaxus.ch/en/page/woul...
@pougorg.bsky.social
about 2 months ago
1
8
0
1/11 Everything changes... turns out the age-old rule that lgwr writes out the log buffer when it's 1/3 full no longer applies in recent Oracle versions. Observations below from 19.26 (with RAC on Exadata). 👇
3 months ago
1
2
0
Week end fun: snooping inter-process messaging (ksbasend) in Oracle with bpftrace. 🤓
t.ly/_yDy7
3 months ago
0
2
0
thehackernews.com/2025/10/link...
loading . . .
LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packets
Synacktiv uncovered LinkPro, a Golang rootkit using eBPF hide/knock modules activated by TCP window 54321.
https://thehackernews.com/2025/10/linkpro-linux-rootkit-uses-ebpf-to-hide.html
3 months ago
0
0
0
This, so much! 👇
add a skeleton here at some point
3 months ago
0
3
0
www.deep-kondah.com/deep-dive-in...
loading . . .
Unraveling eBPF Ring Buffers
The goal of this post is to provide an in-depth discussion of BPF ring buffers, covering their internals, including memory allocation, user-space mapping, locking mechanisms, and efficient data sharin...
https://www.deep-kondah.com/deep-dive-into-ebpf-ring-buffers/
3 months ago
0
1
0
When you plan to geek out over some oracle internals, but end up ftrace’ing bpf the entire week end to chase a funny bug that only occurs on exadata with capacity on demand ...
4 months ago
0
1
0
reposted by
Christoph Lutz
Jonathan Lewis
4 months ago
There's a problem on the oracle-l listserver at present about an insert taking far too much time (and CPU). It's a known issue and there are 47 statistics in v$sysstat (19.11) with names like 'ASSM%' to help diagnose it. How many do you think are described in the database reference manual? None.
0
4
1
Yet another adaptive lgwr optimization: on Exadata X10+, pipelined log writes may defer redo writes until a suitably sized write batch has accumulated in the log buffer. The deferral can involve spinning in a tight loop up to 25 times (maximum hard-coded in kcrfw_defer_write).
4 months ago
1
2
0
Nested loops, baby 😜
4 months ago
0
1
0
4 months ago
0
5
0
reposted by
Christoph Lutz
Swiss Oracle User Group
4 months ago
In den nächsten Tagen veröffentlichen wir nicht nur die Agenda, sondern am Tag nach dem SOUG Day planen wir noch ein Special für Euch! Schaut rein und meldet Euch an unter
soug.ch
.
0
3
3
So glad that all new features are documented so well... NOT 😜 Manually enabling and disabling adaptive lgwr evaluation trace for pipelined / overlapped redo writes:
5 months ago
0
0
0
POUG journey started… not even at the airport and lufthansa’s delay notification leaves no hope of making the connecting flight in MUC 🙈
5 months ago
0
3
0
So 23ai replaces ksesecl0(func, loc, err) with kseseclv(err, func, loc, ...) ... Why is it always just a few days before POUG that this kind of low-level discoveries surface? 🙄
5 months ago
2
3
0
reposted by
Christoph Lutz
Tanel Poder
5 months ago
A new tool in 0x.tools family: xtop - Top for Wall-Clock Time. It uses eBPF/xcapture v3 and gives you "x-ray vision" into Linux system activity. It will be available on next Tuesday 19 Aug at 1pm EDT when I also run a live demo webinar!
tanelpoder.com/posts/xtop-t...
1
19
9
"Slide n of 142".. this is getting out of control... 🙈
add a skeleton here at some point
5 months ago
0
1
0
Today's discovery (19.26): Oracle derives different log parallelism defaults, depending on platform. Max number of public redo strands is: Exadata: CPU_COUNT <= 256: 16 CPU_COUNT> 256: CPU_COUNT/16 Non-Exadata: CPU_COUNT <= 32: 2 CPU_COUNT > 32: CPU_COUNT/16 Max limit: 256
6 months ago
0
0
0
Oh my, looks like the "ms" in "kso_sched_delay_avg_ms" actually means "microseconds" ... 🤷♂️
6 months ago
1
3
0
1/6 The "redo synch time overhead" in Oracle is the difference between a FG's log file sync (LFS) wait end time and LGWR's redo write completion time. LGWR and LG workers track the redo write completion times in the "write info array" in the SGA.
6 months ago
1
0
0
lgwr: You have the control gdb: I have the control
6 months ago
0
0
0
Over the past few weeks, my understanding of undocumented LGWR mechanics has improved quite a bit, and I'm now tempted to write a talk titled "LGWR beyond the docs - what Oracle didn't write to disk" 😉
add a skeleton here at some point
6 months ago
2
6
1
1/4 In Adaptive Scalable mode, lgwr can dynamically assign multiple lg workers to process a redo write in parallel when these conditions are met: - redo write size > KSFD_MAXIO (usually 1 MB) - _max_log_write_parallelism > 1 - active public redo strands > 1
6 months ago
1
0
0
The trace below shows lg00 submitting a log write at T4 (lwn scn 0x70f14b55773) while lg04's earlier write submitted at T2 (lwn 0x70f14b55768) is still in flight, suggesting Pipelined Log Writes. But the trace is from an X8, not X10, where the feature is documented ...🤔 (I/Os throttled for testing)
6 months ago
0
2
0
1/7 On Exadata with pmemlog, the Fast Log File Sync dynamically tunes the log file sync sleep duration to balance responsiveness vs cpu ovherhead (spinning after wakeup). Oracle tracks three wait variants via different session stat counters: 1. Sleep 2. Spin 3. Backoff Sleeps
6 months ago
1
1
0
If you've ever felt the need to manually control adaptive lgwr features, this gdb script's got you covered:
t.ly/lJIW1
😎 It lets you enable and disable adaptive scalable lgwr, fast log file sync, and log parallelism. Highly experimental, of course! Example 👇
6 months ago
0
3
0
Geeky Sunday mission accomplished… 💥✌️😎 The Fast Sync sleep duration used during log file sync waits is an adaptive moving average calculated every 3 sec by ckpt. For the curious, more details in this python script:
tinyurl.com/mrycy7zh
More explanations will follow some other time.
add a skeleton here at some point
6 months ago
0
1
0
Week end plan: figure out how Fast Sync calculates the adaptive sleep duration used during log file sync waits. Answer is in the numbers below ... 🤔
6 months ago
0
0
1
Life before dynamic tracing: sleep. Life after: desperately trying not to lose your mind while chasing one more elusive oracle code path … 🐇🕳️
6 months ago
0
2
0
Haven't used good old perf for a while and forgot how cool it actually is. Wondering what process and code paths on your system modify a memory address? perf's got you covered: perf record -a -g -e mem:<addr>:w
6 months ago
1
1
0
Tired: Trust the abstraction Wired: Trace the abstraction
7 months ago
0
0
0
1/10 The log parallelism feature has been part of Oracle since 9i (20+ years or so), but surprisingly, there's not much information available on how it really works. Time for a closer look ... 👇
7 months ago
1
5
2
Went through to Texas, yeah, Texas… and we had some fun 🤘
7 months ago
0
0
0
Been digging into lgwr mechanics lately, and whew, have they become dynamic ... log parallelism, adaptive log file sync, fast sync, adaptive scalable lgwr, pipelined log writes, ... Wondering if anybody actually knows how all these features work and interact with each other 🤔
7 months ago
2
1
1
reposted by
Christoph Lutz
Oracle Exadata Product Management
8 months ago
🚨 Hot off the Press! 🚨 Excited about the powerful new
#Oracle
Database Snapshot and Cloning features now available with
#Exadata
#Exascale
? Don’t miss out—get the latest
#MAA
Best Practices Guide and start cloning with confidence! A huge thank you to the incredible MAA and Engineering teams!
loading . . .
https://www.oracle.com/docs/tech/database/exadata_exascale_snapshot_clone_maa_best_practices.pdf
0
6
3
1/9 Interesting redo buffer allocation mechanics in Oracle, showing how much care and thought have gone into the rdbms design.
8 months ago
1
5
0
So much fabric, so little bag … this compression ratio would make HCC weep, and it decompresses in a flash … 😉 Blue skies!
8 months ago
0
3
0
1/10 Redo copy latch internals - Part 2: lgwr mechanics This explains what happens during a "LGWR wait for redo copy" event.
8 months ago
1
3
0
1/11 A thread on Oracle redo copy latch internals. Part 1 - FG latch acquisition
8 months ago
1
4
1
Interesting data, indeed. 😉 (gdb) call (void) kcrfw_dump_interesting_data()
8 months ago
0
0
0
reposted by
Christoph Lutz
Christian Marquardt
9 months ago
Don‘t miss the all new SOUG DEV Day in Zurich and learn about the great but unfortunately not well known feature „property graphs“ presented by the product manager Hans Viehmann 👍
soug.ch/event/sougde...
loading . . .
SOUG DEV Day – Let’s Talk Property Graphs! - SOUG
https://soug.ch/event/sougdevday25/
0
2
2
reposted by
Christoph Lutz
Tanel Poder
9 months ago
0x.tools
xCapture v3: Linux Performance Analysis with Modern eBPF and DuckDB 👀👀
tanelpoder.com/posts/xcaptu...
1
29
12
Intel PT is pretty cool technology. Give it a try if it‘s available on one of your machines 😉
2024.bsidesmunich.org/talks/002-07...
loading . . .
Reverse Engineering and Control Flow Analysis with Intel Processor Trace
https://2024.bsidesmunich.org/talks/002-07_ZVGDJW_reverse-engineering-and-control-flow-analysis-with-intel-processor-trace/
10 months ago
0
0
0
reposted by
Christoph Lutz
Kamil Stawiarski
11 months ago
JAS-MIN just got integration with OpenAI ant - to be honest - we're a bit impressed :D
github.com/ora600pl/jas...
0
7
1
For geeks: two bpftrace scripts to map UTS event and component names to their internal ids.
t.ly/bGj0M
t.ly/ypKuv
Didn’t plan on it, but sometimes the rabbit hole chooses you... Turns out "oradebug doc" doesn't expose all trace events.
11 months ago
1
3
3
How come I only found out about the bpf based tpcdump implementation "ptcpdump" today? This enables packet filtering by process, user and container. Now waiting for the next network issue 😉
t.ly/jbrJH
loading . . .
GitHub - mozillazg/ptcpdump: Process-aware, eBPF-based tcpdump
Process-aware, eBPF-based tcpdump. Contribute to mozillazg/ptcpdump development by creating an account on GitHub.
https://t.ly/jbrJH
11 months ago
0
3
1
Load more
feeds!
log in