uprobe
also: user-space probe, user probe
A dynamic tracing mechanism that allows you to insert instrumentation points into user-space applications at runtime without recompiling code, capturing function calls and variable values.
A uprobe (user-space probe) is a Linux kernel feature that lets you dynamically attach tracing code to any function or instruction in a running user-space process. Unlike static instrumentation, uprobes require no code changes or recompilation—you simply specify a binary path, function name or offset, and the kernel inserts a breakpoint at that location.
When the target instruction executes, the kernel pauses the process and runs your probe handler, which can log data, capture registers, or count events. This is invaluable for debugging production applications, profiling hotspots, or understanding unexpected behavior without stopping and rebuilding.
For example, you could trace every call to malloc() in a running web server: echo 'p:/lib/libc.so.6:malloc' > /sys/kernel/debug/tracing/uprobe_events, then read the trace output in real-time from the kernel's tracing infrastructure.
Uprobes are commonly used with tools like trace-cmd, perf, and BPF programs to build powerful observability without application-level logging overhead.