From raw data to flame graphs: A deep dive into how the OpenTelemetry eBPF profiler symbolizes Go

This article details the complex process of symbolization – converting raw memory addresses captured by eBPF profilers into human-readable function names. It explains how, unlike traditional profilers, eBPF profilers operate at the kernel level and must reconstruct this information by analyzing binary files after capturing data. Notably, Go programs benefit from a built-in data structure (`.gopclntab`) that allows for more accurate symbolization, even with stripped binaries, making them easier to profile than languages relying solely on server-side symbol lookup.