Dissecting Storage I/O Tracing Overhead of eBPF: A Component-Level Analysis

Extended Berkeley Packet Filter (eBPF) has become a key technology for low-overhead observability in Linux-based systems, enabling secure, dynamic and programmable tracing of kernel subsystems. However, when applied to intensive storage I/O workloads, the actual performance impact of eBPF tracing and the related cost of its internal components remain insufficiently characterized. In this paper, we present a component-level analysis of eBPF-based I/O tracing, focusing on the I/O execution path and proposing a decomposition of the tracing pipeline into its main cost factors. To quantify the cost of each stage, we introduce a controlled experimental framework that incrementally enables tracing components to isolate their individual overhead. Our results show that eBPF tracing overhead is highly workload-dependent, reaching up to 41% under small I/O requests with high concurrency. A component-level analysis identifies userspace event retrieval and probe triggering as the primary bottlenecks, responsible for up to 24% and 11% of the overall overhead, respectively.