bpftool-perf(8)

💖 bpftool-perf ✨

okay bestie, so this is the bpftool-perf page from the System Manager's Manual — it's the little corner of bpftool that's all about peeking at perf-related BPF program attachments. literally all the vibes of "who attached what to where" 🔍💅

---

🌸 NAME 🌸

bpftool-perf — the tool for inspection of perf related bpf prog attachments 🫶

---

✨ SYNOPSIS ✨

bpftool [OPTIONS] perf COMMAND

OPTIONS := { { -j | --json } [{ -p | --pretty }] | { -d | --debug } }

COMMANDS := { show | list | help }

---

🎀 PERF COMMANDS 🎀

bpftool perf { show | list }
bpftool perf help

---

🦋 DESCRIPTION 🦋

bpftool perf { show | list }

it lists every raw_tracepoint, tracepoint, and kprobe attachment chillin' in the system, no cap 🫡

the output starts with the process id and the file descriptor inside that process, then the bpf program id, then the attachment info, and finally the attachment point 💫

so like, what even is the attachment point for each one? let's break it down bestie:

• for raw_tracepoint/tracepoint it's the trace probe name
• for k[ret]probe it's either the symbol name and offset, or a kernel virtual address
• for u[ret]probe it's the file name and the file offset

bpftool perf help

just prints a short help message. short king energy 👑

---

💅 OPTIONS 💅

• -h, --help — prints the short help message (basically the same vibe as bpftool help) 🙋‍♀️
• -V, --version — prints bpftool's version number (similar to bpftool version), the number of the libbpf version in use, and, bestie, the optional features that got baked in when bpftool was compiled ✨ those optional features include linking against LLVM or libbfd to give you the disassembler for JIT-ted programs (bpftool prog dump jited) and usage of BPF skeletons (and heads up, some features like bpftool prog profile or showing pids associated to BPF objects may rely on it) 🧚
• -j, --json — generates JSON output. for commands that can't produce JSON, this option has no effect (it's giving "I'm here but I'm not doing anything" 💀)
• -p, --pretty — generates human-readable JSON output. implies -j 🎀
• -d, --debug — prints all logs available, even debug-level information. this includes logs from libbpf as well as from the verifier, when attempting to load programs 🔥

---

🌈 EXAMPLES 🌈

# bpftool perf

   pid 21711  fd 5: prog_id 5  kprobe  func __x64_sys_write  offset 0
   pid 21765  fd 5: prog_id 7  kretprobe  func __x64_sys_nanosleep  offset 0
   pid 21767  fd 5: prog_id 8  tracepoint  sys_enter_nanosleep
   pid 21800  fd 5: prog_id 9  uprobe  filename /home/yhs/a.out  offset 1159

# bpftool -j perf

   [{"pid":21711,"fd":5,"prog_id":5,"fd_type":"kprobe","func":"__x64_sys_write","offset":0}, \
    {"pid":21765,"fd":5,"prog_id":7,"fd_type":"kretprobe","func":"__x64_sys_nanosleep","offset":0}, \
    {"pid":21767,"fd":5,"prog_id":8,"fd_type":"tracepoint","tracepoint":"sys_enter_nanosleep"}, \
    {"pid":21800,"fd":5,"prog_id":9,"fd_type":"uprobe","filename":"/home/yhs/a.out","offset":1159}]

---

👑 SEE ALSO 👑

bpf(2), bpf-helpers(7), bpftool(8), bpftool-btf(8), bpftool-cgroup(8), bpftool-feature(8), bpftool-gen(8), bpftool-iter(8), bpftool-link(8), bpftool-map(8), bpftool-net(8), bpftool-prog(8), bpftool-struct_ops(8), bpftool-token(8)

---

and that's the whole page bestie, you ate that 🍓💜 this came from the System Manager's Manual, version <rainbow>bpftool-perf(8)</rainbow>, and the date stamp on it is the same as the page footer — go off, periodt ✨🎀🦋