tldr/pages/linux/bpftrace.md

29 lines
642 B
Markdown
Raw Normal View History

2020-10-17 20:47:18 +01:00
# bpftrace
> High-level tracing language for Linux eBPF.
> More information: <https://github.com/iovisor/bpftrace>.
- Display bpftrace version:
`bpftrace -V`
- List all available probes:
`sudo bpftrace -l`
- Run a one-liner program (e.g. syscall count by program):
2020-10-17 20:47:18 +01:00
`sudo bpftrace -e '{{tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }}}'`
- Run a program from a file:
`sudo bpftrace {{path/to/file}}`
- Trace a program by PID:
`sudo bpftrace -e '{{tracepoint:raw_syscalls:sys_enter /pid == 123/ { @[comm] = count(); }}}'`
- Do a dry run and display the output in eBPF format:
`sudo bpftrace -d -e '{{one_line_program}}'`