Package bpftrace

High-level tracing language for Linux eBPF

https://github.com/iovisor/bpftrace

BPFtrace is a high-level tracing language for Linux enhanced Berkeley Packet
Filter (eBPF) available in recent Linux kernels (4.x). BPFtrace uses LLVM as a
backend to compile scripts to BPF-bytecode and makes use of BCC for
interacting with the Linux BPF system, as well as existing Linux tracing
capabilities: kernel dynamic tracing (kprobes), user-level dynamic tracing
(uprobes), and tracepoints. The BPFtrace language is inspired by awk and C,
and predecessor tracers such as DTrace and SystemTap
System Administration
Command Description
bashreadline Print bash commands system wide. Uses bpftrace/eBPF.
biolatency Block I/O latency as a histogram. Uses bpftrace/eBPF.
biosnoop Block I/O tracing tool, showing per I/O latency. Uses bpftrace/eBPF.
biostacks Show disk I/O latency with initialization stacks. Uses bpftrace/eBPF.
bitesize Show disk I/O size as a histogram. Uses bpftrace/eBPF.
bpftrace the eBPF tracing language & frontend
capable Trace security capability checks (cap_capable()).
cpuwalk Sample which CPUs are executing processes.. Uses bpftrace/eBPF.
dcsnoop Trace directory entry cache (dcache) lookups. Uses bpftrace/eBPF.
execsnoop Trace new processes via exec() syscalls. Uses bpftrace/eBPF.
gethostlatency Show latency for getaddrinfo/gethostbyname[2] calls. Uses bpftrace/eBPF.
killsnoop Trace signals issued by the kill() syscall. Uses bpftrace/eBPF.
loads Prints load averages. Uses bpftrace/eBPF.
mdflush Trace md flush events. Uses bpftrace/eBPF.
naptime Trace voluntary sleep calls. Uses bpftrace/eBPF.
oomkill Trace OOM killer. Uses bpftrace/eBPF.
opensnoop Trace open() syscalls. Uses bpftrace/eBPF.
pidpersec Count new processes (via fork()). Uses bpftrace/eBPF.
runqlat CPU scheduler run queue latency as a histogram. Uses bpftrace/eBPF.
runqlen CPU scheduler run queue length as a histogram. Uses bpftrace/eBPF.
setuids Trace setuid family of syscalls. Uses bpftrace/eBPF.
statsnoop Trace stat() syscalls. Uses bpftrace/eBPF.
swapin Count swapins by process. Uses bpftrace/eBPF.
syncsnoop Trace the sync() variety of syscalls. Uses bpftrace/eBPF.
syscount Count system calls. Uses bpftrace/eBPF.
tcpaccept Trace TCP passive connections (accept()). Uses bpftrace/eBPF
tcpconnect Trace TCP active connections (connect()). Uses Linux bpftrace/eBPF
tcpdrop Trace kernel-based TCP packet drops with details. Uses Linux bpftrace/eBPF
tcplife Trace TCP session lifespans with connection details. Uses bpftrace/eBPF.
tcpretrans Trace or count TCP retransmits. Uses Linux bpftrace/eBPF
tcpsynbl Show the TCP SYN backlog as a histogram. Uses bpftrace/eBPF.
threadsnoop Trace thread creation via pthread_create(). Uses bpftrace/eBPF.
vfscount Count VFS calls ("vfs_*"). Uses bpftrace/eBPF.
vfsstat Count key VFS calls. Uses bpftrace/eBPF.
writeback Trace file system writeback events with details. Uses bpftrace/eBPF.
xfsdist Summarize XFS operation latency. Uses bpftrace/eBPF.