BPF Performance Tools

Appendix A. bpftrace One-Liners

This is a selection of one-liners used throughout this book.

New processes with arguments:

bpftrace -e 'tracepoint:syscalls:sys_enter_execve { join(args->argv); }'

Syscall count by process:

bpftrace -e 'tracepoint:raw_syscalls:sys_enter { @[pid, comm] = count(); }'

Sample running process name at 99 Hertz:

bpftrace -e 'profile:hz:99 { @[comm] = count(); }'

Sample user-level stacks at 49 Hertz, for PID 189:

bpftrace -e 'profile:hz:49 /pid == 189/ { @[ustack] = count(); }'

Trace new threads via pthread_create():

bpftrace -e 'u:/lib/x86_64-linux-gnu/libpthread-2.27.so:pthread_create ...

Get BPF Performance Tools now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.