tldr/pages/linux/bpftrace.md

641 B

bpftrace

High-level tracing language for Linux eBPF. More information: https://github.com/iovisor/bpftrace.

  • Display bpftrace version:

bpftrace -V

  • List all available probes:

sudo bpftrace -l

  • Run a one-liner program (e.g syscall count by program):

sudo bpftrace -e '{{tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }}}'

  • Run a program from a file:

sudo bpftrace {{path/to/file}}

  • Trace a program by PID:

sudo bpftrace -e '{{tracepoint:raw_syscalls:sys_enter /pid == 123/ { @[comm] = count(); }}}'

  • Do a dry run and display the output in eBPF format:

sudo bpftrace -d -e '{{one_line_program}}'