These tools are a small collection curated by the bpftrace maintainers that have been battle-tested and are packaged with bpftrace. We're currently building a set of community tools, which is now accepting contributions.

Read more about how tools get added to this repository.

• tools/bashreadline.bt - Print entered bash commands system wide.
• tools/biolatency.bt - Block I/O latency as a histogram.
• tools/biosnoop.bt - Block I/O tracing tool, showing per I/O latency.
• tools/biostacks.bt - Show disk I/O latency with initialization stacks.
• tools/bitesize.bt - Show disk I/O size as a histogram.
• tools/capable.bt - Trace security capability checks.
• tools/cpuwalk.bt - Sample which CPUs are executing processes.
• tools/dcsnoop.bt - Trace directory entry cache (dcache) lookups.
• tools/execsnoop.bt - Trace new processes via exec() syscalls.
• tools/gethostlatency.bt - Show latency for getaddrinfo/gethostbyname[2] calls.
• tools/killsnoop.bt - Trace signals issued by the kill() syscall.
• tools/loads.bt - Print load averages.
• tools/mdflush.bt - Trace md flush events.
• tools/naptime.bt - Show voluntary sleep calls.
• tools/opensnoop.bt - Trace open() syscalls showing filenames.
• tools/oomkill.bt - Trace OOM killer.
• tools/pidpersec.bt - Count new processes (via fork).
• tools/runqlat.bt - CPU scheduler run queue latency as a histogram.
• tools/runqlen.bt - CPU scheduler run queue length as a histogram.
• tools/setuids.bt - Trace the setuid syscalls: privilege escalation.
• tools/ssllatency.bt - Summarize SSL/TLS handshake latency as a histogram.
• tools/sslsnoop.bt - Trace SSL/TLS handshake, showing latency and return value.
• tools/statsnoop.bt - Trace stat() syscalls for general debugging.
• tools/swapin.bt - Show swapins by process.
• tools/syncsnoop.bt - Trace sync() variety of syscalls.
• tools/syscount.bt - Count system calls.
• tools/tcpaccept.bt - Trace TCP passive connections (accept()).
• tools/tcpconnect.bt - Trace TCP active connections (connect()).
• tools/tcpdrop.bt - Trace kernel-based TCP packet drops with details.
• tools/tcplife.bt - Trace TCP session lifespans with connection details.
• tools/tcpretrans.bt - Trace TCP retransmits.
• tools/tcpsynbl.bt - Show TCP SYN backlog as a histogram.
• tools/threadsnoop.bt - List new thread creation.
• tools/undump.bt - Capture UNIX domain socket packages.
• tools/vfscount.bt - Count VFS calls.
• tools/vfsstat.bt - Count some VFS calls, with per-second summaries.
• tools/writeback.bt - Trace file system writeback events with details.
• tools/xfsdist.bt - Summarize XFS operation latency distribution as a histogram.

For more eBPF observability tools, see bcc tools.