Bpftrace is a powerful tracing tool for Linux that can be used to instrument programs and observe system behavior. In this blog post, we’ll provide a bpftrace cheat sheet with some of the most useful commands and options. We’ll also show how bpftrace can be used to solve real-world problems.
Give me 15 minutes and I'll change your view of Linux tracing
If you’re like me, and you find yourself constantly needing to reference the bpftrace documentation, this blog post is for you! I’ve compiled a list of the most commonly used bpftrace commands and options, as well as some tips and tricks, into a handy dandy cheat sheet. So next time you’re stuck trying to remember how to print the pid of all running processes, or what that one option was to get readable output from your trace, just refer to this blog post and save yourself some time!
bpftrace Commands:
help – Prints help menu
print – Prints contents of variables/arrays/maps (see below for some useful print options)
@[num] – Prints contents of variables/arrays/maps every [num] seconds
Options:
f – forces printing even if value hasn’t changed since last printout # really helpful when tracing something that doesn’t happen often!
histogram(
bpftrace> print @1sec:u32 $vars // will print value of $vars every 1 second in decimal format (unsigned 32-bit integer)
Bpftrace Tutorial
bpftrace is a powerful tracing tool for Linux that allows you to trace programs and observe their behaviour in fine detail. In this tutorial, we’ll show you how to use bpftrace to instrument a simple program and collect some performance data.
We’ll start with a simple hello world program:
#include
$ gcc -o hello-world hello-world.c -lbpftrace
Now that our program is compiled, we can run it under bpftrace like so:
$ bpftrace .
/hello-world Hello, world! ^C $
As you can see, bpftrace simply runs the program and prints its output.
But what if we want to know what’s going on under the hood? That’s where instrumentation comes in. Instrumentation is when you add code to a program to collect data about its execution.
With bpftrace, instrumentation is as simple as adding comments to your code. Let’s add some instrumentation to our hello world program:
#include
\n”); /* This comment will be turned into an instruction * that counts the number of times this line is executed */ return 0; }

Credit: bookauthority.org
How Does Bpftrace Work?
BPFtrace is a high-level tracing language for Linux BPF (Berkeley Packet Filter). It’s used for performance analysis, debugging and observability.
BPFtrace uses a simple C-like syntax to define tracepoints, probes, variables and functions.
These can be combined into powerful scripts to trace programs in user space or kernel functions.
BPFtrace compiles these scripts into BPF bytecode which is then loaded into the kernel via the bpftrace tool. The kernel executes this bytecode when the associated tracepoint or kprobe is hit.
The output of BPFtrace scripts can be customized using print formats which are similar to the C printf function. This makes it easy to get information about the data that your script is tracing.
bpftrace also supports dumping all collected data to disk so that it can be analyzed later using tools like FlameGraphs or perf-tools.
What Tool’S Can You Use to Build an Ebpf Program?
There are a few different tools you can use to build an eBPF program. The most popular one is probably bcc, which is a suite of tools for BPF-based tracing, profiling, and more. There’s also ebpftrace, which is a high-level tracer for eBPF programs.
And lastly, there’s perf, which is a Linux performance monitoring tool that has some support for BPF.
Does Perf Use Ebpf?
Yes, perf uses eBPF. eBPF is a powerful kernel instrumentation framework that allows for safe, efficient monitoring of kernel activity. By using eBPF, perf is able to provide detailed information about what the kernel is doing and how it is performing.
This makes perf an invaluable tool for developers and administrators who need to troubleshoot or optimize their systems.
What is Kprobe?
Kprobe is a tool that allows users to test the read and write speeds of their optical drives. It can be used to troubleshoot issues with slow data transfer rates, or to compare the performance of different drives. Kprobe is available for free from many online sources.
Conclusion
If you’re a fan of using BPF to instrument and observe your systems, then you’ll want to check out this cheat sheet for BPFtrace. BPFtrace is a powerful tracing tool that makes use of the Berkeley Packet Filter (BPF) infrastructure in the Linux kernel. With BPFtrace, you can instrument programs and trace system calls, kprobes, uprobes, and tracepoints.
This cheat sheet will help you get started with BPFtrace and show you some of its most useful features.