bpftrace
High-level tracing language for Linux enhanced Berkeley Packet Filter (eBPF).
Why consider bpftrace?
bpftrace is a high-level tracing language and runtime for Linux eBPF written in C++ by Alastair Robertson. Inspired by DTrace and awk, bpftrace allows engineers to write concise one-liner scripts that inspect kernel probes (kprobes), tracepoints, and userspace probes (uprobes) without overhead.
Learn bpftrace by building
Practical setup notes, real use cases, and copy-ready examples in one focused guide.
In this guide2 sections
Overview of bpftrace
bpftrace executes expressive dynamic kernel probes on live production Linux servers.
Quickstart
# Trace open() syscalls by processsudo bpftrace -e 'tracepoint:syscalls:sys_enter_openat { printf("%s %s\n", comm, str(args->filename)); }'bpftrace is licensed under the Apache License Version 2.0.
Related tools
More options with a similar category or technology profile.
diskus
Minimal, fast alternative to du -sh written in Rust using multi-threaded directory traversal.
peco
Simplistic interactive filtering tool for Unix pipelines, process lists, and file trees.
Dapr CLI
Command-line tool for managing Dapr distributed application runtime environments and sidecars.
Freeze
Generate beautiful image screenshots and SVGs of code snippets and terminal outputs.