ContextQMD
Back to Bpftrace

Tools

tools/README.md

0.25.13.9 KB
Original Source

Tools

These tools are a small collection curated by the bpftrace maintainers that have been battle-tested and are packaged with bpftrace. We're currently building a set of community tools, which is now accepting contributions.

Read more about how tools get added to THIS repository.

Versioned Tools

These tools may be updated to use features available in a yet-to-be-released version of bpftrace. If they are not working on your version of bpftrace, use the links above to get a compatible version of the tool.

  • tools/bashreadline.bt - Print entered bash commands system wide.
  • tools/biolatency.bt - Block I/O latency as a histogram.
  • tools/biosnoop.bt - Block I/O tracing tool, showing per I/O latency.
  • tools/biostacks.bt - Show disk I/O latency with initialization stacks.
  • tools/bitesize.bt - Show disk I/O size as a histogram.
  • tools/capable.bt - Trace security capability checks.
  • tools/cpuwalk.bt - Sample which CPUs are executing processes.
  • tools/dcsnoop.bt - Trace directory entry cache (dcache) lookups.
  • tools/execsnoop.bt - Trace new processes via exec() syscalls.
  • tools/gethostlatency.bt - Show latency for getaddrinfo/gethostbyname[2] calls.
  • tools/killsnoop.bt - Trace signals issued by the kill() syscall.
  • tools/loads.bt - Print load averages.
  • tools/mdflush.bt - Trace md flush events.
  • tools/naptime.bt - Show voluntary sleep calls.
  • tools/opensnoop.bt - Trace open() syscalls showing filenames.
  • tools/oomkill.bt - Trace OOM killer.
  • tools/pidpersec.bt - Count new processes (via fork).
  • tools/runqlat.bt - CPU scheduler run queue latency as a histogram.
  • tools/runqlen.bt - CPU scheduler run queue length as a histogram.
  • tools/setuids.bt - Trace the setuid syscalls: privilege escalation.
  • tools/ssllatency.bt - Summarize SSL/TLS handshake latency as a histogram.
  • tools/sslsnoop.bt - Trace SSL/TLS handshake, showing latency and return value.
  • tools/statsnoop.bt - Trace stat() syscalls for general debugging.
  • tools/swapin.bt - Show swapins by process.
  • tools/syncsnoop.bt - Trace sync() variety of syscalls.
  • tools/syscount.bt - Count system calls.
  • tools/tcpaccept.bt - Trace TCP passive connections (accept()).
  • tools/tcpconnect.bt - Trace TCP active connections (connect()).
  • tools/tcpdrop.bt - Trace kernel-based TCP packet drops with details.
  • tools/tcplife.bt - Trace TCP session lifespans with connection details.
  • tools/tcpretrans.bt - Trace TCP retransmits.
  • tools/tcpsynbl.bt - Show TCP SYN backlog as a histogram.
  • tools/threadsnoop.bt - List new thread creation.
  • tools/undump.bt - Capture UNIX domain socket packages.
  • tools/vfscount.bt - Count VFS calls.
  • tools/vfsstat.bt - Count some VFS calls, with per-second summaries.
  • tools/writeback.bt - Trace file system writeback events with details.
  • tools/xfsdist.bt - Summarize XFS operation latency distribution as a histogram.

For more eBPF observability tools, see bcc tools.