bpftrace
also: eBPF tracing, bpf tracing
bpftrace is a high-level tracing language and tool for Linux that allows you to dynamically instrument kernel and user-space programs using eBPF (extended Berkeley Packet Filter) without modifying or restarting code.
bpftrace provides a simple scripting language for writing performance analysis and debugging tools. It leverages eBPF, a sandbox-like virtual machine in the Linux kernel, to safely run programs that observe system behavior in real-time.
Unlike traditional profilers, bpftrace lets you attach instrumentation to any function, system call, or event dynamically. For example, you can trace every call to malloc(), measure function latency, or count specific network events—all without stopping the application or recompiling.
A simple bpftrace program might look like: kretprobe:do_sys_open { @latency = hist(retval); }, which traces system calls and records their latency. This is far more accessible than writing raw eBPF bytecode or kernel modules.
bpftrace is particularly useful for production troubleshooting, performance tuning, and understanding system behavior when you need ad-hoc visibility without the overhead of traditional profilers.