Dynamic tracing of Linux kernel and userspace using eBPF.
medium risk
bpftrace is a high-level tracing language for eBPF (extended Berkeley Packet Filter). It instruments kernel events, tracepoints, uprobes, and kprobes without kernel modules or reboots. Enables tracing any function call in the kernel or any userspace process.
bpftrace -e 'kprobe:do_sys_open { printf("%s %s\n", comm, str(arg1)); }'Trace every file opened, with process name · explain & risk-check →bpftrace -e 'tracepoint:syscalls:sys_enter_execve { printf("%s\n", str(args->filename)); }'Trace every process execution · explain & risk-check →bpftrace -e 'kretprobe:tcp_connect { @[comm] = count(); } END { print(@); }'Count TCP connections by process · explain & risk-check →bpftrace -l 'tracepoint:syscalls:*'List all available syscall tracepoints · explain & risk-check →Use bpftrace before strace in production — strace uses ptrace (process-attach, ~3x slower), while bpftrace uses eBPF (in-kernel, negligible overhead). Safe to run on live production.
Reference text is hand-written and may be incomplete — check man bpftrace for your version. Test destructive commands on a non-production system first.