So far, we have used USDT as a building block of h2olog. However, we continue to face issues:

• On Ubuntu 20.04, we had to patch libbcc.
• On Ubuntu 22.04, it seems like there's another issue.
• Current approach is too slow that many events get dropped when tracing a fast QUIC connection.
• Under heavy load, events being emitted from different threads become significantly reordered ([h2olog] switch from perf buffer to ring buffer #2800).

Generally speaking, USDT is a great tool. We can:

• Attach probes to any number of probe points, not only inside the h2o process but inside kernel as well.
• Run tiny programs (eBPF) to extract whatever data we want to.
• We also use USDT + eBPF to inject information to h2o (-A and -S option of h2olog).

But for h2olog, we do not need the full flexibility.

What we need are:

• Attach to the specified probe points defined inside h2o / quicly / picotls.
• For each probe point being attached, emit information in the form defined in the h2o source tree.
• Limit connections being tracked, by random ratio or IP address (-A and -S options).
• Speed and reliability.

It would not be difficult to build something that meets these criteria, without using a "runtime." Note that we already have the necessary logic for filtering based on IP address: h2o_connect_lookup_acl.