Why bpf_ktime_get_ns() Is Useless for Log Timestamps (and What to Use Instead)

232 · Barun Acharya · Feb. 28, 2026, 10:08 a.m.
Summary
This blog post discusses the pitfalls of using bpf_ktime_get_ns() for timestamping events in eBPF tools, detailing how it can lead to incorrect timestamps that hinder event correlation. The author suggests alternative methods to achieve accurate timestamps for logs and events.