Package bcc-tools

Command line tools for BPF Compiler Collection (BCC)

System Administration
Command Description
argdist Trace a function and display a histogram or frequency count of its parameter...
bashreadline Print entered bash commands system wide. Uses Linux eBPF/bcc.
biolatency Summarize block device I/O latency as a histogram.
biosnoop Trace block device I/O and print details incl. issuing PID.
biotop Block device (disk) I/O by process top.
bitesize Summarize block device I/O size as a histogram — Linux eBPF/bcc.
bpflist Display processes currently using BPF programs and maps.
btrfsdist Summarize btrfs operation latency. Uses Linux eBPF/bcc.
btrfsslower Trace slow btrfs file operations, with per-event details.
cachestat Statistics for linux page cache hit/miss ratios. Uses Linux eBPF/bcc.
cachetop Statistics for linux page cache hit/miss ratios per processes. Uses Linux...
capable Trace security capability checks (cap_capable()).
cpudist On- and off-CPU task time as a histogram.
cpuunclaimed Sample CPU run queues and calculate unclaimed idle CPU. Uses Linux eBPF/bcc.
dbslower Trace MySQL/PostgreSQL server queries slower than a threshold.
dbstat Collect histograms of MySQL/PostgreSQL query latencies.
dcsnoop Trace directory entry cache (dcache) lookups. Uses Linux eBPF/bcc.
dcstat Directory entry cache (dcache) stats. Uses Linux eBPF/bcc.
deadlock_detector Find potential deadlocks (lock order inversions) in a running program.
execsnoop Trace new processes via exec() syscalls. Uses Linux eBPF/bcc.
ext4dist Summarize ext4 operation latency. Uses Linux eBPF/bcc.
ext4slower Trace slow ext4 file operations, with per-event details.
filelife Trace the lifespan of short-lived files. Uses Linux eBPF/bcc.
fileslower Trace slow synchronous file reads and writes.
filetop File reads and writes by filename and process. Top for files.
funccount Count function, tracepoint, and USDT probe calls matching a pattern. Uses Linux...
funclatency Time functions and print latency as a histogram.
funcslower Trace slow kernel or user function calls.
gethostlatency Show latency for getaddrinfo/gethostbyname[2] calls. Uses Linux eBPF/bcc.
hardirqs Measure hard IRQ (hard interrupt) event time. Uses Linux eBPF/bcc.
killsnoop Trace signals issued by the kill() syscall. Uses Linux eBPF/bcc.
llcstat Summarize CPU cache references and misses by process. Uses Linux eBPF/bcc.
mdflush Trace md flush events. Uses Linux eBPF/bcc.
memleak Print a summary of outstanding allocations and their call stacks to detect...
mountsnoop Trace mount() and umount() syscalls. Uses Linux eBPF/bcc.
mysqld_qslower Trace MySQL server queries slower than a threshold.
nfsdist Summarize NFS operation latency. Uses Linux eBPF/bcc.
nfsslower Trace slow NFS file operations, with per-event details.
offcputime Summarize off-CPU time by kernel stack trace. Uses Linux eBPF/bcc.
offwaketime Summarize blocked time by off-CPU stack + waker stack. Uses Linux eBPF/bcc.
oomkill Trace oom_kill_process(). Uses Linux eBPF/bcc.
opensnoop Trace open() syscalls. Uses Linux eBPF/bcc.
pidpersec Count new processes (via fork()). Uses Linux eBPF/bcc.
profile Profile CPU usage by sampling stack traces. Uses Linux eBPF/bcc.
reset-trace reset the state of tracing.
runqlat Run queue (scheduler) latency as a histogram.
runqlen Scheduler run queue length as a histogram.
slabratetop Kernel SLAB/SLUB memory cache allocation rate top. Uses Linux BPF/bcc.
softirqs Measure soft IRQ (soft interrupt) event time. Uses Linux eBPF/bcc.
sslsniff Print data passed to OpenSSL. Uses Linux eBPF/bcc.
stackcount Count function calls and their stack traces. Uses Linux eBPF/bcc.
statsnoop Trace stat() syscalls. Uses Linux eBPF/bcc.
syncsnoop Trace sync() syscall. Uses Linux eBPF/bcc.
syscount Summarize syscall counts and latencies.
tcpaccept Trace TCP passive connections (accept()). Uses Linux eBPF/bcc.
tcpconnect Trace TCP active connections (connect()). Uses Linux eBPF/bcc.
tcpconnlat Trace TCP active connection latency. Uses Linux eBPF/bcc.
tcplife Trace TCP sessions and summarize lifespan. Uses Linux eBPF/bcc.
tcpretrans Trace TCP retransmits and TLPs. Uses Linux eBPF/bcc.
tcptop Summarize TCP send/recv throughput by host. Top for TCP.
tcptracer Trace TCP established connections. Uses Linux eBPF/bcc.
tplist Display kernel tracepoints or USDT probes and their formats.
ttysnoop Watch output from a tty or pts device. Uses Linux eBPF/bcc.
ucalls Summarize method calls from high-level languages and Linux syscalls.
uflow Print a flow graph of method calls in high-level languages.
ugc Trace garbage collection events in high-level languages.
uobjnew Summarize object allocations in high-level languages.
ustat Activity stats from high-level languages.
uthreads Trace thread creation events in Java or pthreads.
vfscount Count VFS calls ("vfs_*"). Uses Linux eBPF/bcc.
vfsstat Statistics for some common VFS calls. Uses Linux eBPF/bcc.
wakeuptime Summarize sleep to wakeup time by waker kernel stack. Uses Linux eBPF/bcc.
xfsdist Summarize XFS operation latency. Uses Linux eBPF/bcc.
xfsslower Trace slow xfs file operations, with per-event details.
zfsdist Summarize ZFS operation latency. Uses Linux eBPF/bcc.
zfsslower Trace slow zfs file operations, with per-event details.