Command line tools for BPF Compiler Collection (BCC)
https://github.com/iovisor/bcc
Version: 0.30.0
System Administration | |
| bcc-argdist | Trace a function and display a histogram or frequency count of its parameter values. Uses Linux eBPF/bcc. |
| bcc-bashreadline | Print entered bash commands system wide. Uses Linux eBPF/bcc. |
| bcc-bindsnoop | Trace bind() system calls. |
| bcc-biolatency | Summarize block device I/O latency as a histogram. |
| bcc-biolatpcts | Monitor IO latency distribution of a block device. |
| bcc-biopattern | Identify random/sequential disk access patterns. |
| bcc-biosnoop | Trace block device I/O and print details incl. issuing PID. |
| bcc-biotop | Block device (disk) I/O by process top. |
| bcc-bitesize | Summarize block device I/O size as a histogram — Linux eBPF/bcc. |
| bcc-bpflist | Display processes currently using BPF programs and maps. |
| bcc-bps | List all BPF programs. 'ps' for BPF programs. |
| bcc-btrfsdist | Summarize btrfs operation latency. Uses Linux eBPF/bcc. |
| bcc-btrfsslower | Trace slow btrfs file operations, with per-event details. |
| bcc-cachestat | Statistics for linux page cache hit/miss ratios. Uses Linux eBPF/bcc. |
| bcc-cachetop | Statistics for linux page cache hit/miss ratios per processes. Uses Linux eBPF/bcc. |
| bcc-capable | Trace security capability checks (cap_capable()). |
| bcc-cobjnew | alias for bcc-uobjnew |
| bcc-compactsnoop | Trace compact zone events. Uses Linux eBPF/bcc. |
| bcc-cpudist | On- and off-CPU task time as a histogram. |
| bcc-cpuunclaimed | Sample CPU run queues and calculate unclaimed idle CPU. Uses Linux eBPF/bcc. |
| bcc-criticalstat | A tracer to find and report long atomic critical sections in kernel |
| bcc-cthreads | alias for bcc-uthreads |
| bcc-dbslower | Trace MySQL/PostgreSQL server queries slower than a threshold. |
| bcc-dbstat | Collect histograms of MySQL/PostgreSQL query latencies. |
| bcc-dcsnoop | Trace directory entry cache (dcache) lookups. Uses Linux eBPF/bcc. |
| bcc-dcstat | Directory entry cache (dcache) stats. Uses Linux eBPF/bcc. |
| bcc-deadlock | Find potential deadlocks (lock order inversions) in a running program. |
| bcc-dirtop | File reads and writes by directory. Top for directories. |
| bcc-drsnoop | Trace direct reclaim events. Uses Linux eBPF/bcc. |
| bcc-execsnoop | Trace new processes via exec() syscalls. Uses Linux eBPF/bcc. |
| bcc-exitsnoop | Trace all process termination (exit, fatal signal). Uses Linux eBPF/bcc. |
| bcc-ext4dist | Summarize ext4 operation latency. Uses Linux eBPF/bcc. |
| bcc-ext4slower | Trace slow ext4 file operations, with per-event details. |
| bcc-f2fsslower | Trace slow f2fs file operations, with per-event details. |
| bcc-filegone | Trace why file gone (deleted or renamed). Uses Linux eBPF/bcc. |
| bcc-filelife | Trace the lifespan of short-lived files. Uses Linux eBPF/bcc. |
| bcc-fileslower | Trace slow synchronous file reads and writes. |
| bcc-filetop | File reads and writes by filename and process. Top for files. |
| bcc-funccount | Count function, tracepoint, and USDT probe calls matching a pattern. Uses Linux eBPF/bcc. |
| bcc-funcinterval | Time interval between the same function, tracepoint as a histogram. |
| bcc-funclatency | Time functions and print latency as a histogram. |
| bcc-funcslower | Trace slow kernel or user function calls. |
| bcc-gethostlatency | Show latency for getaddrinfo/gethostbyname[2] calls. Uses Linux eBPF/bcc. |
| bcc-hardirqs | Measure hard IRQ (hard interrupt) event time. Uses Linux eBPF/bcc. |
| bcc-inject | injects appropriate error into function if input call chain and predicates are satisfied. Uses Linux eBPF/bcc. |
| bcc-javacalls | alias for bcc-ucalls |
| bcc-javaflow | alias for bcc-uflow |
| bcc-javagc | alias for bcc-ugc |
| bcc-javaobjnew | alias for bcc-uobjnew |
| bcc-javastat | alias for bcc-ustat |
| bcc-javathreads | alias for bcc-uthreads |
| bcc-killsnoop | Trace signals issued by the kill() syscall. Uses Linux eBPF/bcc. |
| bcc-klockstat | Traces kernel mutex lock events and display locks statistics. Uses Linux eBPF/bcc. |
| bcc-ksnoop | tool for tracing kernel function entry/return showing arguments/return values |
| bcc-kvmexit | Display the exit_reason and its statistics of each vm exit. |
| bcc-llcstat | Summarize CPU cache references and misses by process. Uses Linux eBPF/bcc. |
| bcc-mdflush | Trace md flush events. Uses Linux eBPF/bcc. |
| bcc-memleak | Print a summary of outstanding allocations and their call stacks to detect memory leaks. Uses Linux eBPF/bcc. |
| bcc-mountsnoop | Trace mount() and umount() syscalls. Uses Linux eBPF/bcc. |
| bcc-mysqld_qslower | Trace MySQL server queries slower than a threshold. |
| bcc-netqtop | Summarize PPS, BPS, average size of packets and packet counts ordered by packet sizes on each queue of a network interface. |
| bcc-nfsdist | Summarize NFS operation latency. Uses Linux eBPF/bcc. |
| bcc-nfsslower | Trace slow NFS file operations, with per-event details. |
| bcc-nodegc | alias for bcc-ugc |
| bcc-nodestat | alias for bcc-ustat |
| bcc-offcputime | Summarize off-CPU time by kernel stack trace. Uses Linux eBPF/bcc. |
| bcc-offwaketime | Summarize blocked time by off-CPU stack + waker stack. Uses Linux eBPF/bcc. |
| bcc-oomkill | Trace oom_kill_process(). Uses Linux eBPF/bcc. |
| bcc-opensnoop | Trace open() syscalls. Uses Linux eBPF/bcc. |
| bcc-perlcalls | alias for bcc-ucalls |
| bcc-perlflow | alias for bcc-uflow |
| bcc-perlstat | alias for bcc-ustat |
| bcc-phpcalls | alias for bcc-ucalls |
| bcc-phpflow | alias for bcc-uflow |
| bcc-phpstat | alias for bcc-ustat |
| bcc-pidpersec | Count new processes (via fork()). Uses Linux eBPF/bcc. |
| bcc-ppchcalls | Summarize ppc hcall counts and latencies. |
| bcc-profile | Profile CPU usage by sampling stack traces. Uses Linux eBPF/bcc. |
| bcc-pythoncalls | alias for bcc-ucalls |
| bcc-pythonflow | alias for bcc-uflow |
| bcc-pythongc | alias for bcc-ugc |
| bcc-pythonstat | alias for bcc-ustat |
| bcc-rdmaucma | Trace RDMA Userspace Connection Manager Access Event. For Linux, uses BCC, eBPF. |
| bcc-readahead | Show performance of read-ahead cache |
| bcc-reset-trace | reset the state of tracing. |
| bcc-rubycalls | alias for bcc-ucalls |
| bcc-rubyflow | alias for bcc-uflow |
| bcc-rubygc | alias for bcc-ugc |
| bcc-rubyobjnew | alias for bcc-uobjnew |
| bcc-rubystat | alias for bcc-ustat |
| bcc-runqlat | Run queue (scheduler) latency as a histogram. |
| bcc-runqlen | Scheduler run queue length as a histogram. |
| bcc-runqslower | Trace long process scheduling delays. |
| bcc-shmsnoop | Trace System V shared memory syscalls. Uses Linux eBPF/bcc. |
| bcc-slabratetop | Kernel SLAB/SLUB memory cache allocation rate top. Uses Linux BPF/bcc. |
| bcc-sofdsnoop | traces FDs passed by sockets |
| bcc-softirqs | Measure soft IRQ (soft interrupt) event time. Uses Linux eBPF/bcc. |
| bcc-solisten | Trace listening socket |
| bcc-spfdsnoop | Trace FDs passed through unix sockets. Uses Linux eBPF/bcc. |
| bcc-sslsniff | Print data passed to OpenSSL, GnuTLS or NSS. Uses Linux eBPF/bcc. |
| bcc-stackcount | Count function calls and their stack traces. Uses Linux eBPF/bcc. |
| bcc-statsnoop | Trace stat() syscalls. Uses Linux eBPF/bcc. |
| bcc-swapin | Count swapins by process. Uses BCC/eBPF. |
| bcc-syncsnoop | Trace sync() syscall. Uses Linux eBPF/bcc. |
| bcc-syscount | Summarize syscall counts and latencies. |
| bcc-tclcalls | alias for bcc-ucalls |
| bcc-tclflow | alias for bcc-uflow |
| bcc-tclobjnew | alias for bcc-uobjnew |
| bcc-tclstat | alias for bcc-ustat |
| bcc-tcpaccept | Trace TCP passive connections (accept()). Uses Linux eBPF/bcc. |
| bcc-tcpcong | Measure tcp congestion state duration. Uses Linux eBPF/bcc. |
| bcc-tcpconnect | Trace TCP active connections (connect()). Uses Linux eBPF/bcc. |
| bcc-tcpconnlat | Trace TCP active connection latency. Uses Linux eBPF/bcc. |
| bcc-tcpdrop | Trace kernel-based TCP packet drops with details. Uses Linux eBPF/bcc. |
| bcc-tcplife | Trace TCP sessions and summarize lifespan. Uses Linux eBPF/bcc. |
| bcc-tcpretrans | Trace or count TCP retransmits and TLPs. Uses Linux eBPF/bcc. |
| bcc-tcprtt | Trace TCP RTT of established connections. Uses Linux eBPF/bcc. |
| bcc-tcpstates | Trace TCP session state changes with durations. Uses Linux eBPF/bcc. |
| bcc-tcpsubnet | Summarize and aggregate IPv4 TCP traffic by subnet. |
| bcc-tcpsynbl | Show the TCP SYN backlog as a histogram. Uses BCC/eBPF. |
| bcc-tcptop | Summarize TCP send/recv throughput by host. Top for TCP. |
| bcc-tcptracer | Trace TCP established connections. Uses Linux eBPF/bcc. |
| bcc-threadsnoop | Trace thread creation via pthread_create(). Uses BCC/eBPF. |
| bcc-tplist | Display kernel tracepoints or USDT probes and their formats. |
| bcc-trace | Trace a function and print its arguments or return value, optionally evaluating a filter. Uses Linux eBPF/bcc. |
| bcc-ttysnoop | Watch output from a tty or pts device. Uses Linux eBPF/bcc. |
| bcc-ucalls | Summarize method calls from high-level languages and Linux syscalls. |
| bcc-uflow | Print a flow graph of method calls in high-level languages. |
| bcc-ugc | Trace garbage collection events in high-level languages. |
| bcc-uobjnew | Summarize object allocations in high-level languages. |
| bcc-ustat | Activity stats from high-level languages. |
| bcc-uthreads | Trace thread creation events in Java or pthreads. |
| bcc-vfscount | Count VFS calls ("vfs_*"). Uses Linux eBPF/bcc. |
| bcc-vfsstat | Statistics for some common VFS calls. Uses Linux eBPF/bcc. |
| bcc-virtiostat | Trace VIRTIO devices input/output statistics. Uses Linux eBPF/bcc. |
| bcc-wakeuptime | Summarize sleep to wakeup time by waker kernel stack. Uses Linux eBPF/bcc. |
| bcc-wqlat | Summarize kernel workqueue latency as a histogram. |
| bcc-xfsdist | Summarize XFS operation latency. Uses Linux eBPF/bcc. |
| bcc-xfsslower | Trace slow xfs file operations, with per-event details. |
| bcc-zfsdist | Summarize ZFS operation latency. Uses Linux eBPF/bcc. |
| bcc-zfsslower | Trace slow zfs file operations, with per-event details. |