From raw data to flame graphs: A deep dive into how the OpenTelemetry eBPF profiler symbolizes Go

This post explains how the OpenTelemetry eBPF profiler converts raw memory addresses into readable function names (symbolization) for Go programs.

• •eBPF profilers operate at the kernel level and capture only raw program counters (hex addresses), unable to access language runtime APIs or modify running processes
• •Go binaries embed a .gopclntab section that maps function address ranges to names and source locations, enabling on-target symbolization even in stripped binaries
• •The symbolization pipeline searches ELF symbol tables and .gopclntab to resolve addresses like 0xf0318 to function names like main.processRequest
• •Symbol information (.gopclntab + DWARF debug sections) can account for roughly 35% of a Go binary's total size
• •