💾 Archived View for freeshell.de › tldr › bpftrace.gmi captured on 2023-06-16 at 17:25:32. Gemini links have been rewritten to link to archived content

View Raw

More Information

⬅️ Previous capture (2022-04-28)

-=-=-=-=-=-=-

bpftrace

High-level tracing language for Linux eBPF.

More information.

• Display bpftrace version:

bpftrace -V

• List all available probes:

sudo bpftrace -l

• Run a one-liner program (e.g. syscall count by program):

sudo bpftrace -e '{tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }}'

• Run a program from a file:

sudo bpftrace {path/to/file}

• Trace a program by PID:

sudo bpftrace -e '{tracepoint:raw_syscalls:sys_enter /pid == 123/ { @[comm] = count(); }}'

• Do a dry run and display the output in eBPF format:

sudo bpftrace -d -e '{one_line_program}'

Copyright © 2014—present the tldr-pages team and contributors.

This work is licensed under the Creative Commons Attribution 4.0 International License (CC-BY).

CC-BY