Package bpftrace

High-level tracing language for Linux eBPF

https://github.com/iovisor/bpftrace

BPFtrace is a high-level tracing language for Linux enhanced Berkeley Packet
Filter (eBPF) available in recent Linux kernels (4.x). BPFtrace uses LLVM as a
backend to compile scripts to BPF-bytecode and makes use of BCC for
interacting with the Linux BPF system, as well as existing Linux tracing
capabilities: kernel dynamic tracing (kprobes), user-level dynamic tracing
(uprobes), and tracepoints. The BPFtrace language is inspired by awk and C,
and predecessor tracers such as DTrace and SystemTap
System Administration
Command Description
bashreadline Print bash commands system wide. Uses bpftrace/eBPF.
biolatency Block I/O latency as a histogram. Uses bpftrace/eBPF.
biosnoop Block I/O tracing tool, showing per I/O latency. Uses bpftrace/eBPF.
bitesize Show disk I/O size as a histogram. Uses bpftrace/eBPF.
bpftrace the eBPF tracing language & frontend
capable Trace security capability checks (cap_capable()).
cpuwalk Sample which CPUs are executing processes.. Uses bpftrace/eBPF.
dcsnoop Trace directory entry cache (dcache) lookups. Uses bpftrace/eBPF.
execsnoop Trace new processes via exec() syscalls. Uses bpftrace/eBPF.
gethostlatency Show latency for getaddrinfo/gethostbyname[2] calls. Uses bpftrace/eBPF.
killsnoop Trace signals issued by the kill() syscall. Uses bpftrace/eBPF.
loads Prints load averages. Uses bpftrace/eBPF.
mdflush Trace md flush events. Uses bpftrace/eBPF.
oomkill Trace OOM killer. Uses bpftrace/eBPF.
opensnoop Trace open() syscalls. Uses bpftrace/eBPF.
pidpersec Count new processes (via fork()). Uses bpftrace/eBPF.
runqlat CPU scheduler run queue latency as a histogram. Uses bpftrace/eBPF.
runqlen CPU scheduler run queue length as a histogram. Uses bpftrace/eBPF.
statsnoop Trace stat() syscalls. Uses bpftrace/eBPF.
syncsnoop Trace the sync() variety of syscalls. Uses bpftrace/eBPF.
syscount Count system calls. Uses bpftrace/eBPF.
vfscount Count VFS calls ("vfs_*"). Uses bpftrace/eBPF.
vfsstat Count key VFS calls. Uses bpftrace/eBPF.
writeback Trace file system writeback events with details. Uses bpftrace/eBPF.
xfsdist Summarize XFS operation latency. Uses bpftrace/eBPF.