threadsnoop.bt(8)

📦
version 0.27.0 · 3 versions
  • 0.27.0 · alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, debian trixie, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking (latest)
  • 0.14.0 · ubuntu jammy
  • 0.20.2 · ubuntu noble
, in alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, debian trixie, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking

🎀 threadsnoop.bt(8) 🎀

✨ NAME ✨

threadsnoop.bt is the tool that spills the tea on thread creation via pthread_create() 💅 It's built on bpftrace/eBPF 🐝

🔮 SYNOPSIS 🔮

threadsnoop.bt

💖 DESCRIPTION 💖

okay so threadsnoop traces calls to pthread_create() and shows you the path of thread creation 🧵 It's giving workload characterization and discovery vibes, and it's the bestie of execsnoop.bt(8), which traces execve(2) 🫶

This works by tracing pthread_create() from libpthread.so.0. Heads up 🙈 the path to this library might need adjusting in the tool source so it matches your system.

🔒 Since this uses BPF, only the root user can run this tool. No sneaking around, bestie.

📋 REQUIREMENTS 📋

You need CONFIG_BPF and bpftrace. No cap, those are the whole checklist ✨

🧪 EXAMPLES 🧪

Trace calls to pthread_create():

# threadsnoop.bt

🏷️ FIELDS 🏷️

⏰ TIME(ms)

The elapsed time since the tool started tracing, in milliseconds ⏱️

🆔 PID

The process ID 🪪

🧵 COMM

The process (thread) name 🎀

🎯 FUNC

The name of the start routine, if the symbol is available 🔍 If it isn't, you get a hex address for the start routine address instead 🧚

🌿 OVERHEAD 🌿

Thread creation is expected to be low (<< 1000/s), so the overhead of this tool is expected to be negligible 🍓 Lowkey the chillest tool ever.

📚 SOURCE 📚

This tool originated from the book "BPF Performance Tools", published by Addison Wesley (2019) 📖 Check it out here: http://www.brendangregg.com/bpf-performance-tools-book.html

See the book for more documentation on this tool 🤓

This version lives in the bpftrace repository: https://github.com/bpftrace/bpftrace 💜

Also look in the bpftrace distribution for a companion _examples.txt file. It has example usage, output, and commentary for this tool, so it's basically a cheat sheet 📝

💻 OS 💻

Linux 🐧

🚧 STABILITY 🚧

Unstable - in development. It's still cooking, so don't be shocked if things shift 🍳

👩‍💻 AUTHOR 👩‍💻

Brendan Gregg 👑

🔗 SEE ALSO 🔗

execsnoop.bt(8) 🦋

Sign-off: this page is from the USER COMMANDS section and was last updated 2019-07-02, and threadsnoop.bt(8) is still slaying 💅🌈

📦 where this page comes from