bpftrace(8)
bpftrace is a high-level tracing language for dynamic instrumentation of the Linux kernel and applications using eBPF.
Synopsis
bpftrace [OPTION]... 'PROGRAM' | bpftrace [OPTION]... -f FILEDescription
bpftrace is a domain-specific language and runtime for writing efficient kernel and application tracers. It compiles to eBPF bytecode and allows you to dynamically instrument kernel functions, tracepoints, userspace functions, and more without modifying code or restarting services.
Programs can attach to kprobes, uprobes, tracepoints, USDT probes, and other event sources. bpftrace automatically manages eBPF maps and provides built-in variables like pid, uid, comm, func, and args.
Requires root privileges and a kernel with eBPF support (Linux 4.4+).
Common options
| Flag | What it does |
|---|---|
-f FILE | read program from file instead of command line |
-l | list available tracepoints, kprobes, and uprobes |
-e PROGRAM | execute program (alternative to positional argument) |
-B MODE | set output buffering mode: line, full, or none |
-v | verbose output; show generated eBPF bytecode and verifier logs |
-d | debug mode; print internal state and AST |
-q | quiet mode; suppress startup message |
--help | display help message and exit |
--version | show bpftrace version |
Examples
print the command name every time openat() syscall is entered
sudo bpftrace -e 'tracepoint:syscalls:sys_enter_openat { print(comm); }'aggregate bytes read by process using kprobe on vfs_read()
sudo bpftrace -e 'kprobe:vfs_read { @bytes[comm] = sum(arg2); }'trace bash readline() function calls and print arguments
sudo bpftrace -e 'uprobe:/bin/bash:readline { printf("%s\n", str(arg0)); }'count context switches per process name
sudo bpftrace -e 'tracepoint:sched:sched_switch { @[curtask->comm] = count(); }'list all available tracepoints containing 'tcp'
sudo bpftrace -l | grep tcprun a bpftrace program stored in script.bt file
sudo bpftrace -f script.btcount system calls to do_sys_open() keyed by filename (arg1)
sudo bpftrace -e 'kprobe:do_sys_open { @[arg1] = count(); }'verbose mode showing generated eBPF bytecode
sudo bpftrace -v -e 'kprobe:schedule { print("scheduled"); }' 2>&1 | grep bytecode