bpftrace

bpftrace is an open source tracing tool and a high-level language for eBPF on Linux. It enables dynamic instrumentation of both the kernel and user-space programs without modifying source code, by compiling scripts into eBPF bytecode that runs in the kernel or tracing environment. The goal is to provide a concise, readable way to observe system behavior and performance characteristics.

The bpftrace language supports attaching to a variety of probes, including kprobes and uprobes for function entry and exit, tracepoints, and user-space dynamic tracing (USDT) probes. Programs describe events of interest, optional filters, and actions that aggregate data or print results. Common capabilities include counters, sums, averages, and histograms, often collected in maps and reported to the user. Output can be printed live or exported for further analysis, enabling rapid investigation of performance problems or behavioral questions.

Implementation and requirements: bpftrace relies on LLVM/Clang to generate eBPF bytecode and a runtime to load and manage the programs in the kernel, typically via libbpf. Running bpftrace requires a Linux system with eBPF support and sufficient privileges (usually root or equivalent capabilities). The eBPF verifier enforces safety constraints to prevent unsafe kernel interactions.

Usage context and scope: bpftrace is commonly used for performance profiling, debugging, and root-cause analysis in production and development environments. It complements lower-level tracing tools by offering a higher-level, scriptable interface. For further details, users can consult the project repository and documentation, which describe supported probes, data structures, and examples.