Bpftrace

• bashreadline.bt.bt(8) Print bash commands system wide. Uses bpftrace/eBPF.
• biolatency.bt.bt(8) Block I/O latency as a histogram. Uses bpftrace/eBPF.
• biosnoop.bt.bt(8) Block I/O tracing tool, showing per I/O latency. Uses bpftrace/eBPF.
• biostacks.bt.bt(8) Show disk I/O latency with initialization stacks. Uses bpftrace/eBPF.
• bitesize.bt.bt(8) Show disk I/O size as a histogram. Uses bpftrace/eBPF.
• bpftrace(8) a high-level tracing language
• capable.bt.bt(8) Trace security capability checks (cap_capable()).
• cpuwalk.bt.bt(8) Sample which CPUs are executing processes.. Uses bpftrace/eBPF.
• dcsnoop.bt.bt(8) Trace directory entry cache (dcache) lookups. Uses bpftrace/eBPF.
• execsnoop.bt.bt(8) Trace new processes via exec() syscalls. Uses bpftrace/eBPF.
• gethostlatency.bt.bt(8) Show latency for getaddrinfo/gethostbyname[2] calls. Uses bpftrace/eBPF.
• killsnoop.bt.bt(8) Trace signals issued by the kill() syscall. Uses bpftrace/eBPF.
• loads.bt.bt(8) Prints load averages. Uses bpftrace/eBPF.
• mdflush.bt.bt(8) Trace md flush events. Uses bpftrace/eBPF.
• naptime.bt.bt(8) Trace voluntary sleep calls. Uses bpftrace/eBPF.
• oomkill.bt.bt(8) Trace OOM killer. Uses bpftrace/eBPF.
• opensnoop.bt.bt(8) Trace open() syscalls. Uses bpftrace/eBPF.
• pidpersec.bt.bt(8) Count new processes (via fork()). Uses bpftrace/eBPF.
• runqlat.bt.bt(8) CPU scheduler run queue latency as a histogram. Uses bpftrace/eBPF.
• runqlen.bt.bt(8) CPU scheduler run queue length as a histogram. Uses bpftrace/eBPF.
• setuids.bt.bt(8) Trace setuid family of syscalls. Uses bpftrace/eBPF.
• ssllatency.bt.bt(8) Show SSL/TLS handshake latency histogram. Uses bpftrace/eBPF.
• sslsnoop.bt.bt(8) Show SSL/TLS handshake events. Uses bpftrace/eBPF.
• statsnoop.bt.bt(8) Trace stat() syscalls. Uses bpftrace/eBPF.
• swapin.bt.bt(8) Count swapins by process. Uses bpftrace/eBPF.
• syncsnoop.bt.bt(8) Trace the sync() variety of syscalls. Uses bpftrace/eBPF.
• syscount.bt.bt(8) Count system calls. Uses bpftrace/eBPF.
• tcpaccept.bt.bt(8) Trace TCP passive connections (accept()). Uses bpftrace/eBPF
• tcpconnect.bt.bt(8) Trace TCP active connections (connect()). Uses Linux bpftrace/eBPF
• tcpdrop.bt.bt(8) Trace kernel-based TCP packet drops with details. Uses Linux bpftrace/eBPF
• tcplife.bt.bt(8) Trace TCP session lifespans with connection details. Uses bpftrace/eBPF.
• tcpretrans.bt.bt(8) Trace or count TCP retransmits. Uses Linux bpftrace/eBPF
• tcpsynbl.bt.bt(8) Show the TCP SYN backlog as a histogram. Uses bpftrace/eBPF.
• threadsnoop.bt.bt(8) Trace thread creation via pthread_create(). Uses bpftrace/eBPF.
• undump.bt.bt(8) Catch UNIX domain socket packages. Uses bpftrace/eBPF.
• vfscount.bt.bt(8) Count VFS calls ("vfs_*"). Uses bpftrace/eBPF.
• vfsstat.bt.bt(8) Count key VFS calls. Uses bpftrace/eBPF.
• writeback.bt.bt(8) Trace file system writeback events with details. Uses bpftrace/eBPF.
• xfsdist.bt.bt(8) Summarize XFS operation latency. Uses bpftrace/eBPF.