Alternatives to bpftrace
A high-level tracing language and command-line tool for observing the Linux kernel and processes with eBPF. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
bpftrace
A high-level tracing language and command-line tool for observing the Linux kernel and processes with eBPF.
Replacements
Listings that take over the same core job as bpftrace.
sysdig
A Linux command-line tool for exploring and troubleshooting systems by capturing system calls, with container support.
Sysdig captures system calls rather than running custom eBPF scripts, adds container awareness and an interactive csysdig terminal interface, and still has a steep learning curve for filters.
Inspektor Gadget
eBPF-based tools for inspecting and debugging Kubernetes clusters and Linux hosts.
Inspektor Gadget offers ready-made eBPF gadgets with container- and Kubernetes-aware output, plus a framework for custom gadgets, but targets cluster operators more than one-line ad hoc scripts.
Similar software
Related functionality, not a direct replacement.
Tracee
A Linux runtime security and forensics tool that traces system events using eBPF.
Tetragon
An eBPF-based security observability and runtime enforcement tool for Linux hosts and Kubernetes clusters.
Parca
Open-source continuous profiler that uses eBPF to track CPU and memory use down to the line.
Performance Co-Pilot
A toolkit for collecting, archiving and analysing performance metrics across many systems.
Coroot
Investigate application behavior using automatically collected observability data.
Hubble
A network, service and security observability tool for Kubernetes clusters running Cilium, built on eBPF.
