Meta’s eBPF case study is primarily about Strobelight, a production profiling service that coordinates multiple profilers to help engineers find performance bottlenecks. Some profilers use eBPF to collect information from the Linux kernel, but Strobelight is not a single eBPF program. The eBPF Foundation’s 2025 case study reports substantial CPU and server-capacity savings at Meta; those are Meta-specific reported results, not a general promise for other deployments.
What is eBPF?
eBPF is a Linux kernel technology that lets programs run at selected kernel attachment points to observe or act on system events. In Meta’s profiling example, it can help collect performance data from running software without requiring developers to insert profiling code into every application binary. The Meta account and the eBPF Foundation case study emphasize kernel-assisted collection, flexibility, and low overhead as reasons to use eBPF for this work; that does not mean every eBPF program or workload has negligible overhead.
What is Strobelight, and how does Meta use eBPF?
Meta describes Strobelight as a profiling orchestrator: a service that coordinates different profilers rather than one profiler or one technology. It gathers statistical samples and other performance information from running processes on production hosts. Engineers can run a profiler on demand or configure collection to run continuously or in response to a trigger. Meta’s January 2025 description said the system included 42 profilers at that time; the figure is a dated snapshot, not a current inventory.
The profilers cover different questions, including CPU use, memory allocation, function calls and call stacks, language-specific events, time spent off-CPU, request latency, and AI/GPU workloads. Collection can happen out of process, and the system supports call-stack profiling for native and non-native languages. This range is why it is more accurate to think of Strobelight as a profiling service that can use eBPF, rather than as an eBPF profiler with a single purpose. Meta’s Strobelight engineering account describes the service and its design.
#1 Best Overall
How does eBPF profiling work?
A profiler samples activity rather than recording every operation. Depending on the profiler and question, the collected information can help engineers connect resource use to functions, call stacks, kernel activity, or request behavior. eBPF can provide a way to observe kernel-level events and relate them to running workloads, while the broader service coordinates collection and presents data for analysis.
This approach can avoid the need to modify application binaries solely to add profiling instrumentation. It also allows different profilers to address different kinds of workloads. The trade-off is that attaching to kernel events, collecting samples, and storing or processing their data still consume resources. The useful design goal is therefore not simply “collect everything,” but to gather enough representative information to diagnose problems without causing significant workload or storage harm.
How did Strobelight reduce CPU usage?
The eBPF Foundation’s 2025 Strobelight case study reports a 20% reduction in CPU cycles and says this equated to 10–20% fewer required servers for Meta’s top services. It also reports annual capacity savings equivalent to 15,000 servers from a single one-character code change. The case study does not identify that character in its PDF text, so the specific change cannot be inferred from the published claim.
These figures describe outcomes reported for Meta’s environment. The case study does not provide independent measurement or reproducibility details for them, and they should not be read as results that an average Strobelight user—or any arbitrary eBPF deployment—will achieve. Their significance is that profiling can expose small, high-impact inefficiencies at production scale, where reducing CPU work can translate into meaningful capacity savings.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
What makes profiling on production hosts difficult?
Kernel differences and compatibility
Meta operates hosts with varied kernel versions, so a profiler cannot assume every feature is available or behaves identically everywhere. The case study describes compatibility handling and fallbacks when a kernel feature is unavailable. This matters because a profiling service needs to function across a fleet, not just on a carefully controlled test machine.
Sampling overhead and data volume
More frequent or broader collection can produce more data, but can also add overhead to the systems being measured. Strobelight’s described safeguards include dynamic sampling so collection can be adjusted, along with limits on concurrency and queuing to manage profiler activity. These controls address both sides of the problem: keeping profiling useful while limiting competition for resources and avoiding an unmanageable flow of samples.
Choosing the right profiler
Different questions call for different collection methods. CPU and call-stack data can help locate compute-heavy code; memory profiling can point to allocation behavior; off-CPU and request-latency data can reveal delays that raw CPU usage misses; AI/GPU profiling can examine accelerator workloads. A broad profiler catalog is useful only when collection is targeted to a diagnostic question and run with appropriate safeguards.
How Strobelight differs from Meta’s other eBPF systems
Meta has described other eBPF-based systems, but they do different jobs. Katran and SSLWall are not components of Strobelight; they show the range of ways Meta has applied eBPF.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| System | Job | Technical approach described | Main operational concern |
|---|---|---|---|
| Strobelight | Production profiling and performance analysis | Coordinates multiple profilers; some use eBPF for kernel-assisted collection | Sampling, compatibility, and limiting workload and data-collection impact |
| Katran | Layer 4 network load balancing | An eBPF program with XDP processes packets early in the receive path and selects a backend | Packet-forwarding performance, scalability, and deployment alongside services |
| SSLWall | Encrypted-connection policy enforcement | Uses traffic-control eBPF, kprobes, maps, and a management daemon | Policy rollout, kernel compatibility, and safe enforcement |
Katran’s XDP handler can run in driver mode as a packet arrives at the network interface, before the kernel’s normal networking path takes over. Meta also describes trade-offs such as the performance cost of generic XDP and the use of configurable local state. See Meta’s Katran article for its networking context.
SSLWall addresses a different problem: inspecting and enforcing policy for encrypted connections. Meta’s account describes operational measures such as passive monitoring before enforcement, exceptions for selected traffic, and handling protocols that begin in plaintext before TLS. Those controls belong to connection enforcement, not profiling. More detail is in Meta’s SSLWall article.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the case study shows—and what it does not
Strobelight illustrates how eBPF can support production observability when it is one part of a larger system: profilers select and collect useful signals, an orchestrator coordinates them, and operational safeguards help control their impact across a varied fleet. Meta’s reported results show the potential value of finding and fixing costly inefficiencies at scale. They do not establish that eBPF alone caused the reported savings, or that another organization will see the same outcome; results depend on its workloads, kernel environment, profiling choices, and the optimizations engineers make in response.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors
