bpftrace Tracing Tool

bpftrace is a high-level tracing language for Linux eBPF that enables powerful system observability and performance analysis with minimal code, combining the safety of eBPF with a simple awk-like syntax. Created by Alastair Robertson in 2017, with over 8,500 stars as of 2026, bpftrace is the go-to tool for system administrators and performance engineers for kernel and application tracing. Key features include: tracing probes (kernel tracepoints, kprobes for kernel function entry, kretprobes for kernel function return, uprobes for userspace function entry, uretprobes for return, USDT probes for statically defined userspace tracing points, and profile and interval timers), awk-like syntax (familiar filtering and output syntax with BEGIN and END blocks, maps for aggregating data, and printf for formatted output), one-liners (powerful single-line commands for common tracing tasks like counting syscalls, measuring function latency, and tracking file opens), aggregation functions (count, sum, avg, min, max, hist for power-of-2 histograms, lhist for linear histograms, and stats for statistical summaries), built-in variables (pid, tid, uid, comm, kstack, ustack, arg0-argN for function arguments, retval for return values, and elapsed for timestamps), associative arrays (keyed maps for multi-dimensional data aggregation with tuple keys for grouping by multiple dimensions), string manipulation (str() function for reading userspace strings from kernel, kaddr and uaddr for symbol addresses), batch mode (run scripts from file or stdin for automated tracing), bpftrace tools (collection of pre-built scripts for common analysis tasks in the tools/ directory), and eBPF backend (compiles bpftrace programs to eBPF bytecode via LLVM, loaded into the kernel via bpf(2) syscall with safe execution guarantees).