threadsnoop(8)

✨ threadsnoop(8) ✨

okay so the NAME is threadsnoop 🧚 — it's the tool that traces thread creation via pthread_create() and it uses BCC/eBPF to do it 💜

💅 SYNOPSIS

threadsnoop

🌸 DESCRIPTION

okay so threadsnoop traces calls to pthread_create() and shows you this path of thread creation 👀 this is giving workload characterization and discovery vibes, and it's a bestie of execsnoop(8) which traces execve(2) 🫶

this works by tracing the pthread_create() from libpthread.so.0 ✨ the path to this library might need adjusting in the tool source so it matches your system, so keep that in mind 🙈

since this uses BPF, only the root user can use this tool 💀 no cap, not me being bossy, it's just how it works 😭

🎀 REQUIREMENTS

you need CONFIG_BPF and BCC 🔥

🦋 EXAMPLES

trace calls to pthread_create():

# threadsnoop

🍓 FIELDS

• TIME(ms) — the elapsed time since the tool started tracing, in milliseconds ⏰
• PID — the process ID 🪪
• COMM — the process (thread) name 🧵
• FUNC — the name of the start routine if the symbol is available, otherwise a hex address for the start routine address 🔍

🌈 OVERHEAD

thread creation is expected to be low (<< 1000/s), so the overhead of this tool is expected to be negligible 🥰 lowkey iconic

⭐ SOURCE

this originated as a bpftrace tool from the book "BPF Performance Tools", published by Addison Wesley (2019) 📚

http://www.brendangregg.com/bpf-performance-tools-book.html

see the book for more documentation on this tool 🤓

this version lives in the BCC repository:

https://github.com/iovisor/bcc

also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool 💖

🧚 OS

Linux 🐧

🙈 STABILITY

Unstable - in development. 🚧

👑 AUTHOR

Brendan Gregg 💜

🔗 SEE ALSO

• execsnoop(8) 🫶

---

bestie, that's the whole page 🎀 from threadsnoop(8) in the USER COMMANDS section, dated 2019-07-02, with love from the System Manager's Manual ✨💖