Package bpftrace

High-level tracing language for Linux eBPF

https://github.com/iovisor/bpftrace

BPFtrace is a high-level tracing language for Linux enhanced Berkeley Packet
Filter (eBPF) available in recent Linux kernels (4.x). BPFtrace uses LLVM as a
backend to compile scripts to BPF-bytecode and makes use of BCC for
interacting with the Linux BPF system, as well as existing Linux tracing
capabilities: kernel dynamic tracing (kprobes), user-level dynamic tracing
(uprobes), and tracepoints. The BPFtrace language is inspired by awk and C,
and predecessor tracers such as DTrace and SystemTap

Version: 0.11.0

System Administration

bashreadline Print bash commands system wide. Uses bpftrace/eBPF.
biolatency Block I/O latency as a histogram. Uses bpftrace/eBPF.
biosnoop Block I/O tracing tool, showing per I/O latency. Uses bpftrace/eBPF.
biostacks Show disk I/O latency with initialization stacks. Uses bpftrace/eBPF.
bitesize Show disk I/O size as a histogram. Uses bpftrace/eBPF.
bpftrace the eBPF tracing language & frontend
capable Trace security capability checks (cap_capable()).
cpuwalk Sample which CPUs are executing processes.. Uses bpftrace/eBPF.
dcsnoop Trace directory entry cache (dcache) lookups. Uses bpftrace/eBPF.
execsnoop Trace new processes via exec() syscalls. Uses bpftrace/eBPF.
gethostlatency Show latency for getaddrinfo/gethostbyname[2] calls. Uses bpftrace/eBPF.
killsnoop Trace signals issued by the kill() syscall. Uses bpftrace/eBPF.
loads Prints load averages. Uses bpftrace/eBPF.
mdflush Trace md flush events. Uses bpftrace/eBPF.
naptime Trace voluntary sleep calls. Uses bpftrace/eBPF.
oomkill Trace OOM killer. Uses bpftrace/eBPF.
opensnoop Trace open() syscalls. Uses bpftrace/eBPF.
pidpersec Count new processes (via fork()). Uses bpftrace/eBPF.
runqlat CPU scheduler run queue latency as a histogram. Uses bpftrace/eBPF.
runqlen CPU scheduler run queue length as a histogram. Uses bpftrace/eBPF.
setuids Trace setuid family of syscalls. Uses bpftrace/eBPF.
statsnoop Trace stat() syscalls. Uses bpftrace/eBPF.
swapin Count swapins by process. Uses bpftrace/eBPF.
syncsnoop Trace the sync() variety of syscalls. Uses bpftrace/eBPF.
syscount Count system calls. Uses bpftrace/eBPF.
tcpaccept Trace TCP passive connections (accept()). Uses bpftrace/eBPF
tcpconnect Trace TCP active connections (connect()). Uses Linux bpftrace/eBPF
tcpdrop Trace kernel-based TCP packet drops with details. Uses Linux bpftrace/eBPF
tcplife Trace TCP session lifespans with connection details. Uses bpftrace/eBPF.
tcpretrans Trace or count TCP retransmits. Uses Linux bpftrace/eBPF
tcpsynbl Show the TCP SYN backlog as a histogram. Uses bpftrace/eBPF.
threadsnoop Trace thread creation via pthread_create(). Uses bpftrace/eBPF.
vfscount Count VFS calls ("vfs_*"). Uses bpftrace/eBPF.
vfsstat Count key VFS calls. Uses bpftrace/eBPF.
writeback Trace file system writeback events with details. Uses bpftrace/eBPF.
xfsdist Summarize XFS operation latency. Uses bpftrace/eBPF.