📦 bcc-doc

143 pages

A

argdist(8)Trace a function and display a histogram or frequency count of its parameter values. Uses Linux eBPF/bcc.✨

B

bashreadline(8)Print entered bash commands system wide. Uses Linux eBPF/bcc.✨
bindsnoop(8)Trace bind() system calls.✨
biolatency(8)Summarize block device I/O latency as a histogram.✨
biolatpcts(8)Monitor IO latency distribution of a block device.✨
biopattern(8)Identify random/sequential disk access patterns.✨
biosnoop(8)Trace block device I/O and print details incl. issuing PID.✨
biotop(8)Block device (disk) I/O by process top.✨
bitesize(8)Summarize block device I/O size as a histogram - Linux eBPF/bcc.✨
bpflist(8)Display processes currently using BPF programs and maps.✨
bps(8)List all BPF programs. 'ps' for BPF programs.✨
btrfsdist(8)Summarize btrfs operation latency. Uses Linux eBPF/bcc.✨
btrfsslower(8)Trace slow btrfs file operations, with per-event details.✨

C

cachestat(8)Statistics for linux page cache hit/miss ratios. Uses Linux eBPF/bcc.✨
cachetop(8)Statistics for linux page cache hit/miss ratios per processes. Uses Linux eBPF/bcc.✨
capable(8)Trace security capability checks (cap_capable()).✨
cobjnew(8)Summarize object allocations in high-level languages.✨
compactsnoop(8)Trace compact zone events. Uses Linux eBPF/bcc.✨
cpudist(8)On- and off-CPU task time as a histogram.✨
cpuunclaimed(8)Sample CPU run queues and calculate unclaimed idle CPU. Uses Linux eBPF/bcc.✨
criticalstat(8)A tracer to find and report long atomic critical sections in kernel✨
cthreads(8)Trace thread creation events in Java or pthreads.✨

D

dbslower(8)Trace MySQL/PostgreSQL server queries slower than a threshold.✨
dbstat(8)Collect histograms of MySQL/PostgreSQL query latencies.✨
dcsnoop(8)Trace directory entry cache (dcache) lookups. Uses Linux eBPF/bcc.✨
dcstat(8)Directory entry cache (dcache) stats. Uses Linux eBPF/bcc.✨
deadlock(8)Find potential deadlocks (lock order inversions) in a running program.✨
dirtop(8)File reads and writes by directory. Top for directories.✨
drsnoop(8)Trace direct reclaim events. Uses Linux eBPF/bcc.✨

E

execsnoop(8)Trace new processes via exec() syscalls. Uses Linux eBPF/bcc.✨
exitsnoop(8)Trace all process termination (exit, fatal signal). Uses Linux eBPF/bcc.✨
ext4dist(8)Summarize ext4 operation latency. Uses Linux eBPF/bcc.✨
ext4slower(8)Trace slow ext4 file operations, with per-event details.✨

F

f2fsslower(8)Trace slow f2fs file operations, with per-event details.✨
filegone(8)Trace why file gone (deleted or renamed). Uses Linux eBPF/bcc.✨
filelife(8)Trace the lifespan of short-lived files. Uses Linux eBPF/bcc.✨
fileslower(8)Trace slow synchronous file reads and writes.✨
filetop(8)File reads and writes by filename and process. Top for files.✨
funccount(8)Count function, tracepoint, and USDT probe calls matching a pattern. Uses Linux eBPF/bcc.✨
funcinterval(8)Time interval between the same function, tracepoint as a histogram.✨
funclatency(8)Time functions and print latency as a histogram.✨
funcslower(8)Trace slow kernel or user function calls.✨

G

gethostlatency(8)Show latency for getaddrinfo/gethostbyname[2] calls. Uses Linux eBPF/bcc.✨

H

hardirqs(8)Measure hard IRQ (hard interrupt) event time. Uses Linux eBPF/bcc.✨

I

inject(8)injects appropriate error into function if input call chain and predicates are satisfied. Uses Linux eBPF/bcc.✨

J

javacalls(8)Summarize method calls from high-level languages and Linux syscalls.✨
javaflow(8)Print a flow graph of method calls in high-level languages.✨
javagc(8)Trace garbage collection events in high-level languages.✨
javaobjnew(8)Summarize object allocations in high-level languages.✨
javastat(8)Activity stats from high-level languages.✨
javathreads(8)Trace thread creation events in Java or pthreads.✨

K

killsnoop(8)Trace signals issued by the kill() syscall. Uses Linux eBPF/bcc.✨
klockstat(8)Traces kernel mutex lock events and display locks statistics. Uses Linux eBPF/bcc.✨
ksnoop(8)tool for tracing kernel function entry/return showing arguments/return values✨
kvmexit(8)Display the exit_reason and its statistics of each vm exit.✨

L

llcstat(8)Summarize CPU cache references and misses by process. Uses Linux eBPF/bcc.✨

M

mdflush(8)Trace md flush events. Uses Linux eBPF/bcc.✨
memleak(8)Print a summary of outstanding allocations and their call stacks to detect memory leaks. Uses Linux eBPF/bcc.✨
mountsnoop(8)Trace mount() and umount() syscalls. Uses Linux eBPF/bcc.✨
mysqld_qslower(8)Trace MySQL server queries slower than a threshold.✨

N

netqtop(8)Summarize PPS, BPS, average size of packets and packet counts ordered by packet sizes on each queue of a network interface.✨
nfsdist(8)Summarize NFS operation latency. Uses Linux eBPF/bcc.✨
nfsslower(8)Trace slow NFS file operations, with per-event details.✨
nodegc(8)Trace garbage collection events in high-level languages.✨
nodestat(8)Activity stats from high-level languages.✨
numasched(8)Tracing task switch NUMA. Uses bcc/eBPF.✨

O

offcputime(8)Summarize off-CPU time by kernel stack trace. Uses Linux eBPF/bcc.✨
offwaketime(8)Summarize blocked time by off-CPU stack + waker stack. Uses Linux eBPF/bcc.✨
oomkill(8)Trace oom_kill_process(). Uses Linux eBPF/bcc.✨
opensnoop(8)Trace open() syscalls. Uses Linux eBPF/bcc.✨

P

perlcalls(8)Summarize method calls from high-level languages and Linux syscalls.✨
perlflow(8)Print a flow graph of method calls in high-level languages.✨
perlstat(8)Activity stats from high-level languages.✨
phpcalls(8)Summarize method calls from high-level languages and Linux syscalls.✨
phpflow(8)Print a flow graph of method calls in high-level languages.✨
phpstat(8)Activity stats from high-level languages.✨
pidpersec(8)Count new processes (via fork()). Uses Linux eBPF/bcc.✨
ppchcalls(8)Summarize ppc hcall counts and latencies.✨
profile(8)Profile CPU usage by sampling stack traces. Uses Linux eBPF/bcc.✨
pythoncalls(8)Summarize method calls from high-level languages and Linux syscalls.✨
pythonflow(8)Print a flow graph of method calls in high-level languages.✨
pythongc(8)Trace garbage collection events in high-level languages.✨
pythonstat(8)Activity stats from high-level languages.✨

R

rdmaucma(8)Trace RDMA Userspace Connection Manager Access Event. For Linux, uses BCC, eBPF.✨
readahead(8)Show performance of read-ahead cache✨
reset-trace(8)reset the state of tracing.✨
rubycalls(8)Summarize method calls from high-level languages and Linux syscalls.✨
rubyflow(8)Print a flow graph of method calls in high-level languages.✨
rubygc(8)Trace garbage collection events in high-level languages.✨
rubyobjnew(8)Summarize object allocations in high-level languages.✨
rubystat(8)Activity stats from high-level languages.✨
runqlat(8)Run queue (scheduler) latency as a histogram.✨
runqlen(8)Scheduler run queue length as a histogram.✨
runqslower(8)Trace long process scheduling delays.✨

S

shmsnoop(8)Trace System V shared memory syscalls. Uses Linux eBPF/bcc.✨
slabratetop(8)Kernel SLAB/SLUB memory cache allocation rate top. Uses Linux BPF/bcc.✨
sofdsnoop(8)traces FDs passed by sockets✨
softirqs(8)Measure soft IRQ (soft interrupt) event time. Uses Linux eBPF/bcc.✨
softirqslower(8)Trace softirq handlers with latency exceeding a threshold✨
solisten(8)Trace listening socket✨
spfdsnoop(8)Trace FDs passed through unix sockets. Uses Linux eBPF/bcc.✨
sslsniff(8)Print data passed to OpenSSL, GnuTLS or NSS. Uses Linux eBPF/bcc.✨
stackcount(8)Count function calls and their stack traces. Uses Linux eBPF/bcc.✨
statsnoop(8)Trace stat() syscalls. Uses Linux eBPF/bcc.✨
swapin(8)Count swapins by process. Uses BCC/eBPF.✨
syncsnoop(8)Trace sync() syscall. Uses Linux eBPF/bcc.✨
syscount(8)Summarize syscall counts and latencies.✨

T

tclcalls(8)Summarize method calls from high-level languages and Linux syscalls.✨
tclflow(8)Print a flow graph of method calls in high-level languages.✨
tclobjnew(8)Summarize object allocations in high-level languages.✨
tclstat(8)Activity stats from high-level languages.✨
tcpaccept(8)Trace TCP passive connections (accept()). Uses Linux eBPF/bcc.✨
tcpcong(8)Measure tcp congestion state duration. Uses Linux eBPF/bcc.✨
tcpconnect(8)Trace TCP active connections (connect()). Uses Linux eBPF/bcc.✨
tcpconnlat(8)Trace TCP active connection latency. Uses Linux eBPF/bcc.✨
tcpdrop(8)Trace kernel-based TCP packet drops with details. Uses Linux eBPF/bcc.✨
tcplife(8)Trace TCP sessions and summarize lifespan. Uses Linux eBPF/bcc.✨
tcpretrans(8)Trace or count TCP retransmits and TLPs. Uses Linux eBPF/bcc.✨
tcprtt(8)Trace TCP RTT of established connections. Uses Linux eBPF/bcc.✨
tcpstates(8)Trace TCP session state changes with durations. Uses Linux eBPF/bcc.✨
tcpsubnet(8)Summarize and aggregate IPv4 TCP traffic by subnet.✨
tcpsynbl(8)Show the TCP SYN backlog as a histogram. Uses BCC/eBPF.✨
tcptop(8)Summarize TCP send/recv throughput by host. Top for TCP.✨
tcptracer(8)Trace TCP established connections. Uses Linux eBPF/bcc.✨
threadsnoop(8)Trace thread creation via pthread_create(). Uses BCC/eBPF.✨
tplist(8)Display kernel tracepoints or USDT probes and their formats.✨
trace(8)Postfix delivery status reports✨
ttysnoop(8)snoop on a user's tty✨

U

ucalls(8)Summarize method calls from high-level languages and Linux syscalls.✨
uflow(8)Print a flow graph of method calls in high-level languages.✨
ugc(8)Trace garbage collection events in high-level languages.✨
uobjnew(8)Summarize object allocations in high-level languages.✨
ustat(8)Activity stats from high-level languages.✨
uthreads(8)Trace thread creation events in Java or pthreads.✨

V

vfscount(8)Count VFS calls ("vfs_*"). Uses Linux eBPF/bcc.✨
vfsstat(8)Statistics for some common VFS calls. Uses Linux eBPF/bcc.✨
virtiostat(8)Trace VIRTIO devices input/output statistics. Uses Linux eBPF/bcc.✨

W

wakeuptime(8)Summarize sleep to wakeup time by waker kernel stack. Uses Linux eBPF/bcc.✨
wqlat(8)Summarize kernel workqueue latency as a histogram.✨

X

xfsdist(8)Summarize XFS operation latency. Uses Linux eBPF/bcc.✨
xfsslower(8)Trace slow xfs file operations, with per-event details.✨

Z

zfsdist(8)Summarize ZFS operation latency. Uses Linux eBPF/bcc.✨
zfsslower(8)Trace slow zfs file operations, with per-event details.✨