eBPF Probe Overhead Budget
Estimate the CPU core-equivalent consumed by eBPF probes at a measured event rate, and compare it with a user-defined CPU budget. This is a planning model; measure probe overhead on the target kernel and workload.
Result
Estimated CPU cores used
Share of available CPU
Configured CPU budget
Remaining CPU budget (negative means over budget)
Maximum probes per event within budget
How to use this tool
- Enter the event rate and the number of eBPF probes that run for each event.
- Enter measured average overhead per probe in microseconds, available CPU cores and the CPU percentage budget for instrumentation.
- Review estimated core usage, budget headroom and the maximum whole probe count per event that fits the budget.
Assumptions
- Probe cost is modeled as a constant average per event; it excludes variance, tail latency, map contention, verifier cost, context switches, JIT behavior and interactions between probes.
- The measured overhead and event rate must represent the same kernel, hardware, event path and production-like workload.
- The CPU percentage budget is chosen by the user; this tool does not recommend a production limit.
Technical details: what the fields mean
- Events per second
eventRatePerSecond - Observed or projected events generated per second.
- eBPF probes per event
probesPerEvent - Number of probes executed for each event, averaged to a whole probe count.
- Measured overhead per probe
overheadPerProbeUs - Measured average execution overhead of one probe in microseconds, using the target kernel and representative workload.
- Available CPU cores
availableCpuCores - CPU cores available to the workload against which the percentage and budget are calculated.
- CPU budget for probes
cpuBudgetPercent - Maximum share of available CPU cores reserved for these probes; it is a user-defined budget, not a safe default.
Methodology
CPU cores used = events per second × probes per event × microseconds per probe ÷ 1,000,000. CPU budget cores = available cores × budget percentage. Maximum whole probes per event = floor(budget cores × 1,000,000 ÷ (event rate × microseconds per probe)).
Worked example
Two probes at 400,000 events/s
Inputs: Events per second: 400000 events/s, eBPF probes per event: 2 probes/event, Measured overhead per probe: 4 µs, Available CPU cores: 16 cores, CPU budget for probes: 10%
Result: Estimated use is 3.2 CPU cores (20% of 16 cores). The 10% budget is 1.6 cores, so this setup exceeds it by 1.6 cores; one probe per event fits the simple budget calculation.
Practical guidance
- Measure overhead with the same event type, attachment point, kernel version, maps and probe body that will run in production.
- Use this estimate alongside latency and dropped-event measurements; average CPU alone does not describe tail impact.
Common mistakes
- Using a microbenchmark of an empty probe as the cost of a probe that reads maps, copies data or emits events.
- Multiplying by event rate but forgetting multiple probes may execute for each event.
FAQs
Is eBPF probe overhead always constant?
No. This calculator assumes a constant average per event. Actual cost can vary with program work, kernel path, map access, contention and workload.
Does the CPU budget percentage come from Kubernetes or Linux?
No. It is a planning threshold you choose; the calculator does not read cgroups, Kubernetes limits or host telemetry.
Last reviewed: 2026-10-18
A simple average CPU budget model; it does not predict latency, perf-event loss, kernel scheduling, verifier acceptance, eBPF map pressure or production safety.
This tool provides an indicative estimate, based on the assumptions stated above.
Theme and tool preferences, along with saved and recently used lists, are stored only in this browser.