bpflist(8)

📦 version 0.36.1, in alpine 3.24, nixpkgs unstable, opensuse-leap 16.0

💖 bpflist: Display processes currently using BPF programs and maps 💖

✨ NAME ✨

bpflist - Display processes currently using BPF programs and maps. 🧚

✨ SYNOPSIS ✨

bpflist [-v]

✨ DESCRIPTION ✨

okay so bpflist is the tool that shows you which processes are currently using BPF programs and maps 👀 It can also count kprobes and uprobes on the system if you ask nicely. 🦋 This is lowkey essential if you want to know which BPF programs are loaded on your machine. no cap 💅

ngl the way it works is kinda messy 💀 For lack of a better option, this tool pipes into ls and parses the output to sniff out BPF file descriptors across all the running processes. 🙈 In the future, once the kernel provides BPF accounting, this tool should switch over to using those features instead. we love an upgrade 🫶

🔒 Only the root user can run this tool, because it accesses debugfs. Not you, not me, only root. 😭

✨ REQUIREMENTS ✨

You'll need bcc and debugfs 🌸

✨ OPTIONS ✨

  • -h — Prints the usage message. 💜
  • -v — Counts kprobes and uprobes too, not just BPF programs. 🔥 Repeat verbose mode twice (-v -v) and it also prints the kprobe and uprobe definitions on top of counting them. the main character energy is real 👑

✨ EXAMPLES ✨

Display processes currently using BPF programs: 🍓

# bpflist

Also count kprobes and uprobes: ✨

# bpflist -v

✨ FIELDS ✨

  • PID — The process ID. 🆔
  • COMM — The process comm. 🎀
  • TYPE — The type of data being shown: BPF program, BPF map, kprobe, or uprobe. 🦋
  • COUNT — How many items of this type belong to the specified process. 🧮

✨ SOURCE ✨

This is from bcc. 🐝 The source lives at https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion _examples.txt file. It has example usage, output, and commentary for this tool, so it's giving tutorial energy 📚

✨ OS ✨

Linux 🐧

✨ STABILITY ✨

Unstable, it's still in development. 🚧 Be gentle with it, bestie 🥺

✨ AUTHOR ✨

Sasha Goldshtein 💖

That's the whole page, bestie 🫶 This was bpflist(8) from the USER COMMANDS section, dated 2017-03-09 ✨🌈

📦 where this page comes from