These tools are a small collection curated by the bpftrace maintainers that have been battle-tested and are packaged with bpftrace. We're currently building a set of community tools, which is now accepting contributions.
Read more about how tools get added to this repository.
- tools/bashreadline.bt - Print entered bash commands system wide.
- tools/biolatency.bt - Block I/O latency as a histogram.
- tools/biosnoop.bt - Block I/O tracing tool, showing per I/O latency.
- tools/biostacks.bt - Show disk I/O latency with initialization stacks.
- tools/bitesize.bt - Show disk I/O size as a histogram.
- tools/capable.bt - Trace security capability checks.
- tools/cpuwalk.bt - Sample which CPUs are executing processes.
- tools/dcsnoop.bt - Trace directory entry cache (dcache) lookups.
- tools/execsnoop.bt - Trace new processes via exec() syscalls.
- tools/gethostlatency.bt - Show latency for getaddrinfo/gethostbyname[2] calls.
- tools/killsnoop.bt - Trace signals issued by the kill() syscall.
- tools/loads.bt - Print load averages.
- tools/mdflush.bt - Trace md flush events.
- tools/naptime.bt - Show voluntary sleep calls.
- tools/opensnoop.bt - Trace open() syscalls showing filenames.
- tools/oomkill.bt - Trace OOM killer.
- tools/pidpersec.bt - Count new processes (via fork).
- tools/runqlat.bt - CPU scheduler run queue latency as a histogram.
- tools/runqlen.bt - CPU scheduler run queue length as a histogram.
- tools/setuids.bt - Trace the setuid syscalls: privilege escalation.
- tools/ssllatency.bt - Summarize SSL/TLS handshake latency as a histogram.
- tools/sslsnoop.bt - Trace SSL/TLS handshake, showing latency and return value.
- tools/statsnoop.bt - Trace stat() syscalls for general debugging.
- tools/swapin.bt - Show swapins by process.
- tools/syncsnoop.bt - Trace sync() variety of syscalls.
- tools/syscount.bt - Count system calls.
- tools/tcpaccept.bt - Trace TCP passive connections (accept()).
- tools/tcpconnect.bt - Trace TCP active connections (connect()).
- tools/tcpdrop.bt - Trace kernel-based TCP packet drops with details.
- tools/tcplife.bt - Trace TCP session lifespans with connection details.
- tools/tcpretrans.bt - Trace TCP retransmits.
- tools/tcpsynbl.bt - Show TCP SYN backlog as a histogram.
- tools/threadsnoop.bt - List new thread creation.
- tools/undump.bt - Capture UNIX domain socket packages.
- tools/vfscount.bt - Count VFS calls.
- tools/vfsstat.bt - Count some VFS calls, with per-second summaries.
- tools/writeback.bt - Trace file system writeback events with details.
- tools/xfsdist.bt - Summarize XFS operation latency distribution as a histogram.
For more eBPF observability tools, see bcc tools.