Possible to attach to running process in Linux via BPF or related technologies?

[itamarst]

Using runtime instrumentation would allow not having to start with Fil from the very start, and would make it safe to use with production servers.

In particular, for long-running servers this would make tracking down memory leaks much easier, since it wouldn't need to be attached from the start. One would want to report not peak allocations, as Fil does by default, but rather current allocations. This is somewhat different than Fil's current use case, but it's a real problem people have.

Thanks to @jvns for the inspiration for this idea.

Related:

• https://manpages.debian.org/buster-backports/bpfcc-tools/pythonstat-bpfcc.8.en.html
• https://manpages.debian.org/buster-backports/bpfcc-tools/pythongc-bpfcc.8.en.html