bpftrace
A high-level tracing language and command-line tool for observing the Linux kernel and processes with eBPF.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
About bpftrace
bpftrace lets you write short scripts, often one line, that attach to kernel and user-space events on Linux and report what happens: which files are opened, where time is spent, how long system calls take. It compiles these scripts to eBPF programs that run inside the kernel.
The project ships a set of ready-made tools and manual pages. It suits system administrators and developers investigating performance problems on live Linux systems.
Strengths
- One-line scripts for quick kernel and process tracing
- Ships a collection of ready-made tools
- Very active project with a large contributor base
Limitations
- Linux only and needs a kernel with eBPF support
- Usually requires root privileges
- The tracing language takes some learning
Details
- Pricing
- FreeFree and open source.
- License
- Open source, license not stated
- Developer
- The bpftrace contributors
- Platforms
- Linux, Command line
- How it runs
- Downloadable app
- Account
- Not required
- Works offline
- Yes
- Best suited for
- Investigating performance problems on live Linux systems
- Categories
- System monitoring, CLI tools, Developer tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to bpftrace
Compare allSoftware that can replace bpftrace for an important use case, and what changes if you switch.
sysdig
A Linux command-line tool for exploring and troubleshooting systems by capturing system calls, with container support.
Sysdig captures system calls rather than running custom eBPF scripts, adds container awareness and an interactive csysdig terminal interface, and still has a steep learning curve for filters.
Inspektor Gadget
eBPF-based tools for inspecting and debugging Kubernetes clusters and Linux hosts.
Inspektor Gadget offers ready-made eBPF gadgets with container- and Kubernetes-aware output, plus a framework for custom gadgets, but targets cluster operators more than one-line ad hoc scripts.
Similar software
Related functionality, not necessarily a direct replacement.
Tracee
A Linux runtime security and forensics tool that traces system events using eBPF.
Tetragon
An eBPF-based security observability and runtime enforcement tool for Linux hosts and Kubernetes clusters.
Parca
Open-source continuous profiler that uses eBPF to track CPU and memory use down to the line.
Performance Co-Pilot
A toolkit for collecting, archiving and analysing performance metrics across many systems.
Coroot
Investigate application behavior using automatically collected observability data.
Hubble
A network, service and security observability tool for Kubernetes clusters running Cilium, built on eBPF.
