Bpfcc-Tools

• argdist-bpfcc(8) Trace a function and display a histogram or frequency count of its parameter values. Uses Linux eBPF/bcc.
• bashreadline-bpfcc(8) Print entered bash commands system wide. Uses Linux eBPF/bcc.
• bindsnoop-bpfcc(8) Trace bind() system calls.
• biolatency-bpfcc(8) Summarize block device I/O latency as a histogram.
• biolatpcts-bpfcc(8) Monitor IO latency distribution of a block device.
• biopattern-bpfcc(8) Identify random/sequential disk access patterns.
• biosnoop-bpfcc(8) Trace block device I/O and print details incl. issuing PID.
• biotop-bpfcc(8) Block device (disk) I/O by process top.
• bitesize-bpfcc(8) Summarize block device I/O size as a histogram - Linux eBPF/bcc.
• bpflist-bpfcc(8) Display processes currently using BPF programs and maps.
• btrfsdist-bpfcc(8) Summarize btrfs operation latency. Uses Linux eBPF/bcc.
• btrfsslower-bpfcc(8) Trace slow btrfs file operations, with per-event details.
• cachestat-bpfcc(8) Statistics for linux page cache hit/miss ratios. Uses Linux eBPF/bcc.
• cachetop-bpfcc(8) Statistics for linux page cache hit/miss ratios per processes. Uses Linux eBPF/bcc.
• capable-bpfcc(8) Trace security capability checks (cap_capable()).
• cobjnew-bpfcc(8) Summarize object allocations in
• compactsnoop-bpfcc(8) Trace compact zone events. Uses Linux eBPF/bcc.
• cpudist-bpfcc(8) On- and off-CPU task time as a histogram.
• cpuunclaimed-bpfcc(8) Sample CPU run queues and calculate unclaimed idle CPU. Uses Linux eBPF/bcc.
• criticalstat-bpfcc(8) A tracer to find and report long atomic critical sections in kernel
• cthreads-bpfcc(8) Trace thread creation events in Java or pthreads.
• dbslower-bpfcc(8) Trace MySQL/PostgreSQL server queries slower than a threshold.
• dbstat-bpfcc(8) Collect histograms of MySQL/PostgreSQL query latencies.
• dcsnoop-bpfcc(8) Trace directory entry cache (dcache) lookups. Uses Linux eBPF/bcc.
• dcstat-bpfcc(8) Directory entry cache (dcache) stats. Uses Linux eBPF/bcc.
• deadlock-bpfcc(8) Find potential deadlocks (lock order inversions)
• dirtop-bpfcc(8) File reads and writes by directory. Top for directories.
• drsnoop-bpfcc(8) Trace direct reclaim events. Uses Linux eBPF/bcc.
• execsnoop-bpfcc(8) Trace new processes via exec() syscalls. Uses Linux eBPF/bcc.
• exitsnoop-bpfcc(8) Trace all process termination (exit, fatal signal). Uses Linux eBPF/bcc.
• ext4dist-bpfcc(8) Summarize ext4 operation latency. Uses Linux eBPF/bcc.
• ext4slower-bpfcc(8) Trace slow ext4 file operations, with per-event details.
• filegone-bpfcc(8) Trace why file gone (deleted or renamed). Uses Linux eBPF/bcc.
• filelife-bpfcc(8) Trace the lifespan of short-lived files. Uses Linux eBPF/bcc.
• fileslower-bpfcc(8) Trace slow synchronous file reads and writes.
• filetop-bpfcc(8) File reads and writes by filename and process. Top for files.
• funccount-bpfcc(8) Count function, tracepoint, and USDT probe calls matching a pattern. Uses Linux eBPF/bcc.
• funcinterval-bpfcc(8) Time interval between the same function, tracepoint as a histogram.
• funclatency-bpfcc(8) Time functions and print latency as a histogram.
• funcslower-bpfcc(8) Trace slow kernel or user function calls.
• gethostlatency-bpfcc(8) Show latency for getaddrinfo/gethostbyname[2] calls. Uses Linux eBPF/bcc.
• hardirqs-bpfcc(8) Measure hard IRQ (hard interrupt) event time. Uses Linux eBPF/bcc.
• inject-bpfcc(8) injects appropriate error into function if input call chain and
• javacalls-bpfcc(8) Summarize method calls
• javaflow-bpfcc(8) Print a flow graph of method
• javagc-bpfcc(8) Trace garbage collection events in
• javaobjnew-bpfcc(8) Summarize object allocations in
• javastat-bpfcc(8) Activity stats from
• javathreads-bpfcc(8) Trace thread creation events in Java or pthreads.
• killsnoop-bpfcc(8) Trace signals issued by the kill() syscall. Uses Linux eBPF/bcc.
• klockstat-bpfcc(8) Traces kernel mutex lock events and display locks statistics. Uses Linux eBPF/bcc.
• ksnoop-bpfcc(8) tool for tracing kernel function entry/return showing arguments/return values
• kvmexit-bpfcc(8) Display the exit_reason and its statistics of each vm exit.
• llcstat-bpfcc(8) Summarize CPU cache references and misses by process. Uses Linux eBPF/bcc.
• mdflush-bpfcc(8) Trace md flush events. Uses Linux eBPF/bcc.
• memleak-bpfcc(8) Print a summary of outstanding allocations and their call stacks to detect memory leaks. Uses Linux eBPF/bcc.
• mountsnoop-bpfcc(8) Trace mount() and umount() syscalls. Uses Linux eBPF/bcc.
• mysqld_qslower-bpfcc(8) Trace MySQL server queries slower than a threshold.
• netqtop-bpfcc(8) Summarize PPS, BPS, average size of packets and packet counts ordered by packet sizes
• nfsdist-bpfcc(8) Summarize NFS operation latency. Uses Linux eBPF/bcc.
• nfsslower-bpfcc(8) Trace slow NFS file operations, with per-event details.
• nodegc-bpfcc(8) Trace garbage collection events in
• nodestat-bpfcc(8) Activity stats from
• offcputime-bpfcc(8) Summarize off-CPU time by kernel stack trace. Uses Linux eBPF/bcc.
• offwaketime-bpfcc(8) Summarize blocked time by off-CPU stack + waker stack. Uses Linux eBPF/bcc.
• oomkill-bpfcc(8) Trace oom_kill_process(). Uses Linux eBPF/bcc.
• opensnoop-bpfcc(8) Trace open() syscalls. Uses Linux eBPF/bcc.
• perlcalls-bpfcc(8) Summarize method calls
• perlflow-bpfcc(8) Print a flow graph of method
• perlstat-bpfcc(8) Activity stats from
• phpcalls-bpfcc(8) Summarize method calls
• phpflow-bpfcc(8) Print a flow graph of method
• phpstat-bpfcc(8) Activity stats from
• pidpersec-bpfcc(8) Count new processes (via fork()). Uses Linux eBPF/bcc.
• ppchcalls-bpfcc(8) Summarize ppc hcall counts and latencies.
• profile-bpfcc(8) Profile CPU usage by sampling stack traces. Uses Linux eBPF/bcc.
• pythoncalls-bpfcc(8) Summarize method calls
• pythonflow-bpfcc(8) Print a flow graph of method
• pythongc-bpfcc(8) Trace garbage collection events in
• pythonstat-bpfcc(8) Activity stats from
• readahead-bpfcc(8) Show performance of read-ahead cache
• reset-trace-bpfcc(8) reset the state of tracing.
• rubycalls-bpfcc(8) Summarize method calls
• rubyflow-bpfcc(8) Print a flow graph of method
• rubygc-bpfcc(8) Trace garbage collection events in
• rubyobjnew-bpfcc(8) Summarize object allocations in
• rubystat-bpfcc(8) Activity stats from
• runqlat-bpfcc(8) Run queue (scheduler) latency as a histogram.
• runqlen-bpfcc(8) Scheduler run queue length as a histogram.
• runqslower-bpfcc(8) Trace long process scheduling delays.
• shmsnoop-bpfcc(8) Trace System V shared memory syscalls. Uses Linux eBPF/bcc.
• slabratetop-bpfcc(8) Kernel SLAB/SLUB memory cache allocation rate top.
• sofdsnoop-bpfcc(8) traces FDs passed by sockets
• softirqs-bpfcc(8) Measure soft IRQ (soft interrupt) event time. Uses Linux eBPF/bcc.
• solisten-bpfcc(8) Trace listening socket
• spfdsnoop-bpfcc(8) Trace FDs passed through unix sockets. Uses Linux eBPF/bcc.
• sslsniff-bpfcc(8) Print data passed to OpenSSL, GnuTLS or NSS. Uses Linux eBPF/bcc.
• stackcount-bpfcc(8) Count function calls and their stack traces. Uses Linux eBPF/bcc.
• statsnoop-bpfcc(8) Trace stat() syscalls. Uses Linux eBPF/bcc.
• swapin-bpfcc(8) Count swapins by process. Uses BCC/eBPF.
• syncsnoop-bpfcc(8) Trace sync() syscall. Uses Linux eBPF/bcc.
• syscount-bpfcc(8) Summarize syscall counts and latencies.
• tclcalls-bpfcc(8) Summarize method calls
• tclflow-bpfcc(8) Print a flow graph of method
• tclobjnew-bpfcc(8) Summarize object allocations in
• tclstat-bpfcc(8) Activity stats from
• tcpaccept-bpfcc(8) Trace TCP passive connections (accept()). Uses Linux eBPF/bcc.
• tcpcong-bpfcc(8) Measure tcp congestion state duration. Uses Linux eBPF/bcc.
• tcpconnect-bpfcc(8) Trace TCP active connections (connect()). Uses Linux eBPF/bcc.
• tcpconnlat-bpfcc(8) Trace TCP active connection latency. Uses Linux eBPF/bcc.
• tcpdrop-bpfcc(8) Trace kernel-based TCP packet drops with details. Uses Linux eBPF/bcc.
• tcplife-bpfcc(8) Trace TCP sessions and summarize lifespan. Uses Linux eBPF/bcc.
• tcpretrans-bpfcc(8) Trace or count TCP retransmits and TLPs. Uses Linux eBPF/bcc.
• tcprtt-bpfcc(8) Trace TCP RTT of established connections. Uses Linux eBPF/bcc.
• tcpstates-bpfcc(8) Trace TCP session state changes with durations. Uses Linux eBPF/bcc.
• tcpsubnet-bpfcc(8) Summarize and aggregate IPv4 TCP traffic by subnet.
• tcpsynbl-bpfcc(8) Show the TCP SYN backlog as a histogram. Uses BCC/eBPF.
• tcptop-bpfcc(8) Summarize TCP send/recv throughput by host. Top for TCP.
• tcptracer-bpfcc(8) Trace TCP established connections. Uses Linux eBPF/bcc.
• threadsnoop-bpfcc(8) Trace thread creation via pthread_create(). Uses BCC/eBPF.
• tplist-bpfcc(8) Display kernel tracepoints or USDT probes and their formats.
• trace-bpfcc(8) Trace a function and print its arguments or return value, optionally evaluating a filter. Uses Linux eBPF/bcc.
• ttysnoop-bpfcc(8) Watch output from a tty or pts device. Uses Linux eBPF/bcc.
• ucalls(8) Summarize method calls
• uflow(8) Print a flow graph of method
• ugc(8) Trace garbage collection events in
• uobjnew(8) Summarize object allocations in
• ustat(8) Activity stats from
• uthreads(8) Trace thread creation events in Java or pthreads.
• vfscount-bpfcc(8) Count VFS calls ("vfs_*"). Uses Linux eBPF/bcc.
• vfsstat-bpfcc(8) Statistics for some common VFS calls. Uses Linux eBPF/bcc.
• virtiostat-bpfcc(8) Trace VIRTIO devices input/output statistics. Uses Linux eBPF/bcc.
• wakeuptime-bpfcc(8) Summarize sleep to wakeup time by waker kernel stack. Uses Linux eBPF/bcc.
• xfsdist-bpfcc(8) Summarize XFS operation latency. Uses Linux eBPF/bcc.
• xfsslower-bpfcc(8) Trace slow xfs file operations, with per-event details.
• zfsdist-bpfcc(8) Summarize ZFS operation latency. Uses Linux eBPF/bcc.
• zfsslower-bpfcc(8) Trace slow zfs file operations, with per-event details.