bpftrace eBPF Tracing Language

bpftrace is a high-level tracing language for Linux eBPF (extended Berkeley Packet Filter), enabling developers and system administrators to easily write tracing programs for analyzing system and application behavior. Created by Alastair Robertson in 2018, bpftrace is part of the iovisor project and has become the standard tool for eBPF-based observability. Key features: simple awk-like scripting language for writing one-liner and multi-line tracing programs without writing C code. Built on top of BCC (BPF Compiler Collection) and libbpf for compiling and loading eBPF programs into the kernel. Probes: attaches to kernel tracepoints, kprobes (kernel function entry), kretprobes (kernel function return), uprobes (user function entry), uretprobes (user function return), USDT (Userland Statically Defined Tracing) probes, and interval-based timers. Built-in functions including count, sum, avg, min, max, hist (histogram), lhist (linear histogram), str (string conversion), kstack (kernel stack trace), ustack (user stack trace), and printf for output. Aggregation maps for efficient data collection with automatic per-CPU sharding for lock-free performance. Filtering via predicate expressions (e.g., /pid == 1234/) for selective tracing. Variable support including global variables, thread-local variables, and scratch variables. Map operations including insert, lookup, delete, and clear for custom data management. Time-based aggregation with @start[tid] = nsecs for latency measurement. Kernel and user space tracing in a single program for end-to-end analysis. Output formats including text, JSON, CSV, and histogram visualization. Async output via async printf and async printf-safe. Cross-architecture support for x86_64, ARM64, and others. Used by Netflix, Facebook, and major cloud providers for production observability.