📦 bcc-tools

A

• argdist(8)Trace a function and display a histogram or frequency count of its parameter values. Uses Linux eBPF/bcc.✨

B

• bashreadline(8)Print entered bash commands system wide. Uses Linux eBPF/bcc.✨
• bcc-argdist(8)Trace a function and display a histogram or frequency count of its parameter values. Uses Linux eBPF/bcc.✨
• bcc-bashreadline(8)Print entered bash commands system wide. Uses Linux eBPF/bcc.✨
• bcc-bindsnoop(8)Trace bind() system calls.✨
• bcc-biolatency(8)Summarize block device I/O latency as a histogram.✨
• bcc-biolatpcts(8)Monitor IO latency distribution of a block device.✨
• bcc-biopattern(8)Identify random/sequential disk access patterns.✨
• bcc-biosnoop(8)Trace block device I/O and print details incl. issuing PID.✨
• bcc-biotop(8)Block device (disk) I/O by process top.✨
• bcc-bitesize(8)Summarize block device I/O size as a histogram - Linux eBPF/bcc.✨
• bcc-bpflist(8)Display processes currently using BPF programs and maps.✨
• bcc-bps(8)List all BPF programs. 'ps' for BPF programs.✨
• bcc-btrfsdist(8)Summarize btrfs operation latency. Uses Linux eBPF/bcc.✨
• bcc-btrfsslower(8)Trace slow btrfs file operations, with per-event details.✨
• bcc-cachestat(8)Statistics for linux page cache hit/miss ratios. Uses Linux eBPF/bcc.✨
• bcc-cachetop(8)Statistics for linux page cache hit/miss ratios per processes. Uses Linux eBPF/bcc.✨
• bcc-capable(8)Trace security capability checks (cap_capable()).✨
• bcc-cobjnew(8)Summarize object allocations in high-level languages.✨
• bcc-compactsnoop(8)Trace compact zone events. Uses Linux eBPF/bcc.✨
• bcc-cpudist(8)On- and off-CPU task time as a histogram.✨
• bcc-cpuunclaimed(8)Sample CPU run queues and calculate unclaimed idle CPU. Uses Linux eBPF/bcc.✨
• bcc-criticalstat(8)A tracer to find and report long atomic critical sections in kernel✨
• bcc-cthreads(8)Trace thread creation events in Java or pthreads.✨
• bcc-dbslower(8)Trace MySQL/PostgreSQL server queries slower than a threshold.✨
• bcc-dbstat(8)Collect histograms of MySQL/PostgreSQL query latencies.✨
• bcc-dcsnoop(8)Trace directory entry cache (dcache) lookups. Uses Linux eBPF/bcc.✨
• bcc-dcstat(8)Directory entry cache (dcache) stats. Uses Linux eBPF/bcc.✨
• bcc-deadlock(8)Find potential deadlocks (lock order inversions) in a running program.✨
• bcc-dirtop(8)File reads and writes by directory. Top for directories.✨
• bcc-drsnoop(8)Trace direct reclaim events. Uses Linux eBPF/bcc.✨
• bcc-execsnoop(8)Trace new processes via exec() syscalls. Uses Linux eBPF/bcc.✨
• bcc-exitsnoop(8)Trace all process termination (exit, fatal signal). Uses Linux eBPF/bcc.✨
• bcc-ext4dist(8)Summarize ext4 operation latency. Uses Linux eBPF/bcc.✨
• bcc-ext4slower(8)Trace slow ext4 file operations, with per-event details.✨
• bcc-f2fsslower(8)Trace slow f2fs file operations, with per-event details.✨
• bcc-filegone(8)Trace why file gone (deleted or renamed). Uses Linux eBPF/bcc.✨
• bcc-filelife(8)Trace the lifespan of short-lived files. Uses Linux eBPF/bcc.✨
• bcc-fileslower(8)Trace slow synchronous file reads and writes.✨
• bcc-filetop(8)File reads and writes by filename and process. Top for files.✨
• bcc-funccount(8)Count function, tracepoint, and USDT probe calls matching a pattern. Uses Linux eBPF/bcc.✨
• bcc-funcinterval(8)Time interval between the same function, tracepoint as a histogram.✨
• bcc-funclatency(8)Time functions and print latency as a histogram.✨
• bcc-funcslower(8)Trace slow kernel or user function calls.✨
• bcc-gethostlatency(8)Show latency for getaddrinfo/gethostbyname[2] calls. Uses Linux eBPF/bcc.✨
• bcc-hardirqs(8)Measure hard IRQ (hard interrupt) event time. Uses Linux eBPF/bcc.✨
• bcc-inject(8)injects appropriate error into function if input call chain and predicates are satisfied. Uses Linux eBPF/bcc.✨
• bcc-javacalls(8)Summarize method calls from high-level languages and Linux syscalls.✨
• bcc-javaflow(8)Print a flow graph of method calls in high-level languages.✨
• bcc-javagc(8)Trace garbage collection events in high-level languages.✨
• bcc-javaobjnew(8)Summarize object allocations in high-level languages.✨
• bcc-javastat(8)Activity stats from high-level languages.✨
• bcc-javathreads(8)Trace thread creation events in Java or pthreads.✨
• bcc-killsnoop(8)Trace signals issued by the kill() syscall. Uses Linux eBPF/bcc.✨
• bcc-klockstat(8)Traces kernel mutex lock events and display locks statistics. Uses Linux eBPF/bcc.✨
• bcc-ksnoop(8)tool for tracing kernel function entry/return showing arguments/return values✨
• bcc-kvmexit(8)Display the exit_reason and its statistics of each vm exit.✨
• bcc-llcstat(8)Summarize CPU cache references and misses by process. Uses Linux eBPF/bcc.✨
• bcc-mdflush(8)Trace md flush events. Uses Linux eBPF/bcc.✨
• bcc-memleak(8)Print a summary of outstanding allocations and their call stacks to detect memory leaks. Uses Linux eBPF/bcc.✨
• bcc-mountsnoop(8)Trace mount() and umount() syscalls. Uses Linux eBPF/bcc.✨
• bcc-mysqld_qslower(8)Trace MySQL server queries slower than a threshold.✨
• bcc-netqtop(8)Summarize PPS, BPS, average size of packets and packet counts ordered by packet sizes on each queue of a network interface.✨
• bcc-nfsdist(8)Summarize NFS operation latency. Uses Linux eBPF/bcc.✨
• bcc-nfsslower(8)Trace slow NFS file operations, with per-event details.✨
• bcc-nodegc(8)Trace garbage collection events in high-level languages.✨
• bcc-nodestat(8)Activity stats from high-level languages.✨
• bcc-numasched(8)Tracing task switch NUMA. Uses bcc/eBPF.✨
• bcc-offcputime(8)Summarize off-CPU time by kernel stack trace. Uses Linux eBPF/bcc.✨
• bcc-offwaketime(8)Summarize blocked time by off-CPU stack + waker stack. Uses Linux eBPF/bcc.✨
• bcc-oomkill(8)Trace oom_kill_process(). Uses Linux eBPF/bcc.✨
• bcc-opensnoop(8)Trace open() syscalls. Uses Linux eBPF/bcc.✨
• bcc-perlcalls(8)Summarize method calls from high-level languages and Linux syscalls.✨
• bcc-perlflow(8)Print a flow graph of method calls in high-level languages.✨
• bcc-perlstat(8)Activity stats from high-level languages.✨
• bcc-phpcalls(8)Summarize method calls from high-level languages and Linux syscalls.✨
• bcc-phpflow(8)Print a flow graph of method calls in high-level languages.✨
• bcc-phpstat(8)Activity stats from high-level languages.✨
• bcc-pidpersec(8)Count new processes (via fork()). Uses Linux eBPF/bcc.✨
• bcc-ppchcalls(8)Summarize ppc hcall counts and latencies.✨
• bcc-profile(8)Profile CPU usage by sampling stack traces. Uses Linux eBPF/bcc.✨
• bcc-pythoncalls(8)Summarize method calls from high-level languages and Linux syscalls.✨
• bcc-pythonflow(8)Print a flow graph of method calls in high-level languages.✨
• bcc-pythongc(8)Trace garbage collection events in high-level languages.✨
• bcc-pythonstat(8)Activity stats from high-level languages.✨
• bcc-rdmaucma(8)Trace RDMA Userspace Connection Manager Access Event. For Linux, uses BCC, eBPF.✨
• bcc-readahead(8)Show performance of read-ahead cache✨
• bcc-reset-trace(8)reset the state of tracing.✨
• bcc-rubycalls(8)Summarize method calls from high-level languages and Linux syscalls.✨
• bcc-rubyflow(8)Print a flow graph of method calls in high-level languages.✨
• bcc-rubygc(8)Trace garbage collection events in high-level languages.✨
• bcc-rubyobjnew(8)Summarize object allocations in high-level languages.✨
• bcc-rubystat(8)Activity stats from high-level languages.✨
• bcc-runqlat(8)Run queue (scheduler) latency as a histogram.✨
• bcc-runqlen(8)Scheduler run queue length as a histogram.✨
• bcc-runqslower(8)Trace long process scheduling delays.✨
• bcc-shmsnoop(8)Trace System V shared memory syscalls. Uses Linux eBPF/bcc.✨
• bcc-slabratetop(8)Kernel SLAB/SLUB memory cache allocation rate top. Uses Linux BPF/bcc.✨
• bcc-sofdsnoop(8)traces FDs passed by sockets✨
• bcc-softirqs(8)Measure soft IRQ (soft interrupt) event time. Uses Linux eBPF/bcc.✨
• bcc-softirqslower(8)Trace softirq handlers with latency exceeding a threshold✨
• bcc-solisten(8)Trace listening socket✨
• bcc-spfdsnoop(8)Trace FDs passed through unix sockets. Uses Linux eBPF/bcc.✨
• bcc-sslsniff(8)Print data passed to OpenSSL, GnuTLS or NSS. Uses Linux eBPF/bcc.✨
• bcc-stackcount(8)Count function calls and their stack traces. Uses Linux eBPF/bcc.✨
• bcc-statsnoop(8)Trace stat() syscalls. Uses Linux eBPF/bcc.✨
• bcc-swapin(8)Count swapins by process. Uses BCC/eBPF.✨
• bcc-syncsnoop(8)Trace sync() syscall. Uses Linux eBPF/bcc.✨
• bcc-syscount(8)Summarize syscall counts and latencies.✨
• bcc-tclcalls(8)Summarize method calls from high-level languages and Linux syscalls.✨
• bcc-tclflow(8)Print a flow graph of method calls in high-level languages.✨
• bcc-tclobjnew(8)Summarize object allocations in high-level languages.✨
• bcc-tclstat(8)Activity stats from high-level languages.✨
• bcc-tcpaccept(8)Trace TCP passive connections (accept()). Uses Linux eBPF/bcc.✨
• bcc-tcpcong(8)Measure tcp congestion state duration. Uses Linux eBPF/bcc.✨
• bcc-tcpconnect(8)Trace TCP active connections (connect()). Uses Linux eBPF/bcc.✨
• bcc-tcpconnlat(8)Trace TCP active connection latency. Uses Linux eBPF/bcc.✨
• bcc-tcpdrop(8)Trace kernel-based TCP packet drops with details. Uses Linux eBPF/bcc.✨
• bcc-tcplife(8)Trace TCP sessions and summarize lifespan. Uses Linux eBPF/bcc.✨
• bcc-tcpretrans(8)Trace or count TCP retransmits and TLPs. Uses Linux eBPF/bcc.✨
• bcc-tcprtt(8)Trace TCP RTT of established connections. Uses Linux eBPF/bcc.✨
• bcc-tcpstates(8)Trace TCP session state changes with durations. Uses Linux eBPF/bcc.✨
• bcc-tcpsubnet(8)Summarize and aggregate IPv4 TCP traffic by subnet.✨
• bcc-tcpsynbl(8)Show the TCP SYN backlog as a histogram. Uses BCC/eBPF.✨
• bcc-tcptop(8)Summarize TCP send/recv throughput by host. Top for TCP.✨
• bcc-tcptracer(8)Trace TCP established connections. Uses Linux eBPF/bcc.✨
• bcc-threadsnoop(8)Trace thread creation via pthread_create(). Uses BCC/eBPF.✨
• bcc-tplist(8)Display kernel tracepoints or USDT probes and their formats.✨
• bcc-trace(8)Trace a function and print its arguments or return value, optionally evaluating a filter. Uses Linux eBPF/bcc.✨
• bcc-ttysnoop(8)Watch output from a tty or pts device. Uses Linux eBPF/bcc.✨
• bcc-ucalls(8)Summarize method calls from high-level languages and Linux syscalls.✨
• bcc-uflow(8)Print a flow graph of method calls in high-level languages.✨
• bcc-ugc(8)Trace garbage collection events in high-level languages.✨
• bcc-uobjnew(8)Summarize object allocations in high-level languages.✨
• bcc-ustat(8)Activity stats from high-level languages.✨
• bcc-uthreads(8)Trace thread creation events in Java or pthreads.✨
• bcc-vfscount(8)Count VFS calls ("vfs_*"). Uses Linux eBPF/bcc.✨
• bcc-vfsstat(8)Statistics for some common VFS calls. Uses Linux eBPF/bcc.✨
• bcc-virtiostat(8)Trace VIRTIO devices input/output statistics. Uses Linux eBPF/bcc.✨
• bcc-wakeuptime(8)Summarize sleep to wakeup time by waker kernel stack. Uses Linux eBPF/bcc.✨
• bcc-wqlat(8)Summarize kernel workqueue latency as a histogram.✨
• bcc-xfsdist(8)Summarize XFS operation latency. Uses Linux eBPF/bcc.✨
• bcc-xfsslower(8)Trace slow xfs file operations, with per-event details.✨
• bcc-zfsdist(8)Summarize ZFS operation latency. Uses Linux eBPF/bcc.✨
• bcc-zfsslower(8)Trace slow zfs file operations, with per-event details.✨
• bindsnoop(8)Trace bind() system calls.✨
• biolatency(8)Summarize block device I/O latency as a histogram.✨
• biolatpcts(8)Monitor IO latency distribution of a block device.✨
• biopattern(8)Identify random/sequential disk access patterns.✨
• biosnoop(8)Trace block device I/O and print details incl. issuing PID.✨
• biotop(8)Block device (disk) I/O by process top.✨
• bitesize(8)Summarize block device I/O size as a histogram - Linux eBPF/bcc.✨
• bpflist(8)Display processes currently using BPF programs and maps.✨
• bps(8)List all BPF programs. 'ps' for BPF programs.✨
• btrfsdist(8)Summarize btrfs operation latency. Uses Linux eBPF/bcc.✨
• btrfsslower(8)Trace slow btrfs file operations, with per-event details.✨

C

• cachestat(8)Statistics for linux page cache hit/miss ratios. Uses Linux eBPF/bcc.✨
• cachetop(8)Statistics for linux page cache hit/miss ratios per processes. Uses Linux eBPF/bcc.✨
• capable(8)Trace security capability checks (cap_capable()).✨
• cobjnew(8)Summarize object allocations in high-level languages.✨
• compactsnoop(8)Trace compact zone events. Uses Linux eBPF/bcc.✨
• cpudist(8)On- and off-CPU task time as a histogram.✨
• cpuunclaimed(8)Sample CPU run queues and calculate unclaimed idle CPU. Uses Linux eBPF/bcc.✨
• criticalstat(8)A tracer to find and report long atomic critical sections in kernel✨
• cthreads(8)Trace thread creation events in Java or pthreads.✨

D

• dbslower(8)Trace MySQL/PostgreSQL server queries slower than a threshold.✨
• dbstat(8)Collect histograms of MySQL/PostgreSQL query latencies.✨
• dcsnoop(8)Trace directory entry cache (dcache) lookups. Uses Linux eBPF/bcc.✨
• dcstat(8)Directory entry cache (dcache) stats. Uses Linux eBPF/bcc.✨
• deadlock(8)Find potential deadlocks (lock order inversions) in a running program.✨
• dirtop(8)File reads and writes by directory. Top for directories.✨
• drsnoop(8)Trace direct reclaim events. Uses Linux eBPF/bcc.✨

E

• execsnoop(8)Trace new processes via exec() syscalls. Uses Linux eBPF/bcc.✨
• exitsnoop(8)Trace all process termination (exit, fatal signal). Uses Linux eBPF/bcc.✨
• ext4dist(8)Summarize ext4 operation latency. Uses Linux eBPF/bcc.✨
• ext4slower(8)Trace slow ext4 file operations, with per-event details.✨

F

• f2fsslower(8)Trace slow f2fs file operations, with per-event details.✨
• filegone(8)Trace why file gone (deleted or renamed). Uses Linux eBPF/bcc.✨
• filelife(8)Trace the lifespan of short-lived files. Uses Linux eBPF/bcc.✨
• fileslower(8)Trace slow synchronous file reads and writes.✨
• filetop(8)File reads and writes by filename and process. Top for files.✨
• funccount(8)Count function, tracepoint, and USDT probe calls matching a pattern. Uses Linux eBPF/bcc.✨
• funcinterval(8)Time interval between the same function, tracepoint as a histogram.✨
• funclatency(8)Time functions and print latency as a histogram.✨
• funcslower(8)Trace slow kernel or user function calls.✨

G

• gethostlatency(8)Show latency for getaddrinfo/gethostbyname[2] calls. Uses Linux eBPF/bcc.✨

H

• hardirqs(8)Measure hard IRQ (hard interrupt) event time. Uses Linux eBPF/bcc.✨

I

• inject(8)injects appropriate error into function if input call chain and predicates are satisfied. Uses Linux eBPF/bcc.✨

J

• javacalls(8)Summarize method calls from high-level languages and Linux syscalls.✨
• javaflow(8)Print a flow graph of method calls in high-level languages.✨
• javagc(8)Trace garbage collection events in high-level languages.✨
• javaobjnew(8)Summarize object allocations in high-level languages.✨
• javastat(8)Activity stats from high-level languages.✨
• javathreads(8)Trace thread creation events in Java or pthreads.✨

K

• killsnoop(8)Trace signals issued by the kill() syscall. Uses Linux eBPF/bcc.✨
• klockstat(8)Traces kernel mutex lock events and display locks statistics. Uses Linux eBPF/bcc.✨
• ksnoop(8)tool for tracing kernel function entry/return showing arguments/return values✨
• kvmexit(8)Display the exit_reason and its statistics of each vm exit.✨

L

• llcstat(8)Summarize CPU cache references and misses by process. Uses Linux eBPF/bcc.✨

M

• mdflush(8)Trace md flush events. Uses Linux eBPF/bcc.✨