threadsnoop.bt(8)

📦 version 0.17.0, in debian bookworm

💅 threadsnoop.bt — the manual, but make it cute

okay bestie, welcome to threadsnoop.bt(8), a little page from the System Manager's Manual section 8 (that's the sysadmin-y one, iykyk). It traces thread creation via pthread_create(), and it runs on bpftrace/eBPF. periodt. 🧚

✨ NAME ✨

threadsnoop.bt — trace thread creation via pthread_create(). Uses bpftrace/eBPF. that's the whole vibe. 🦋

✨ SYNOPSIS ✨

threadsnoop.bt

no args, no flags, no drama. just run it. 👑

✨ DESCRIPTION ✨

okay so threadsnoop traces calls to pthread_create(), which literally shows you the whole path of thread creation. super useful for workload characterization and discovery — like, "what is this thing even doing and where do all these threads keep coming from" energy. it's also the companion tool to execsnoop.bt(8), which traces execve(2). one of them watches processes get born, this one watches threads get born. iconic duo fr fr. 💖

how does it do it? it works by tracing the pthread_create() from libpthread.so.0. heads up tho: the path to that library may need adjusting in the tool source to match your system. so if your lib is living somewhere else, you gotta go edit the source, bestie. no cap.

and since this uses BPF, only the root user can use this tool. sorry to the non-root girlies, that's just how it is. 💅

✨ REQUIREMENTS ✨

  • CONFIG_BPF
  • bpftrace

that's it. that's the list. 🌸

✨ EXAMPLES ✨

wanna trace calls to pthread_create()? say less:

# threadsnoop.bt

boom. you're tracing. 🔥

✨ FIELDS ✨

here's what all the columns mean, so you're not out here squinting at your terminal like 👁️👄👁️

  • TIME(ms) — elapsed time since the tool began tracing, measured in milliseconds. like a little stopwatch for your threads, lowkey.
  • PID — the process ID. who's the parent, bestie?
  • COMM — the process (thread) name.
  • FUNC — the name of the start routine, if the symbol is available; otherwise you get a hex address for the start routine address instead. so either a cute lil function name or a mystery address, your call. 🎀

✨ OVERHEAD ✨

good news: thread creation is expected to be low (<< 1000/s), so the overhead of this tool is expected to be negligible. you can basically leave it running and forget about it. slay. ✨

✨ SOURCE ✨

this tool originated from the book "BPF Performance Tools", published by Addison Wesley (2019):

http://www.brendangregg.com/bpf-performance-tools-book.html

see the book for more documentation on this tool. it's giving required reading. 📚

this version is in the bpftrace repository:

https://github.com/iovisor/bpftrace

also look in the bpftrace distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool. yes, there's bonus content. you're welcome. 💖

✨ OS ✨

Linux 🐧

✨ STABILITY ✨

Unstable - in development. so like, it works, but it's still in its growing era. be nice to it. 🌱

✨ AUTHOR ✨

Brendan Gregg — the main character of BPF, honestly. 👑

✨ SEE ALSO ✨

go read that one next, bestie, they're a set. 🫶

and that's the whole page!! this was from the USER COMMANDS manual, dated 2019-07-02, and the page itself is threadsnoop.bt(8) — go trace some threads and have the best day ever, ily 💜✨🎀

📦 where this page comes from