How to Use the Command 'bpftrace' (with Examples)

bpftrace is a high-level tracing language for Linux Extended Berkeley Packet Filter (eBPF), designed to facilitate real-time monitoring and system introspection operations. Utilizing bpftrace, users can create intricate monitoring scenarios with relative ease compared to using raw eBPF. By leveraging the power of eBPF, bpftrace allows you to perform complex performance analysis, debugging, and troubleshooting tasks on live systems without the need for intrusive tools.

Display bpftrace Version

Code:

bpftrace -V

Motivation:

Knowing the version of bpftrace you are working with is crucial for compatibility and debugging purposes. Software tools are frequently updated, with new versions offering enhanced features, security patches, and improved performance. By displaying the bpftrace version, users can ensure they are working with the latest available features and also troubleshoot issues effectively.

Explanation:

• -V: This argument stands for version. It instructs bpftrace to output its current version number.

Example Output:

bpftrace v0.9.3

List All Available Probes

Code:

sudo bpftrace -l

Motivation:

Listing all available probes allows users to understand what events they can trace in the system. Probes are hooks in the kernel or user code, which enable you to monitor events like function calls, CPU usage, and network activity. By knowing what probes are available, users can design more effective monitoring scripts tailored to their specific needs.

Explanation:

• sudo: Superuser privileges are often required to access certain kernel-level data.
• -l: This option commands bpftrace to list all possible probes currently available.

Example Output:

syscall:open
syscall:close
syscall:read
...

Run a One-liner Program (e.g., Syscall Count by Program)

Code:

sudo bpftrace -e 'tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }'

Motivation:

Using a simple one-liner program with bpftrace provides a quick way to monitor system behavior without the need for lengthy scripts or configuration files. This specific example counts syscalls grouped by the program name (comm), which can help in identifying processes making excessive system calls, potentially leading to performance issues.

Explanation:

• -e: This flag indicates the execution of a script provided on the command-line.
• 'tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }': A bpftrace one-liner script. tracepoint:raw_syscalls:sys_enter targets syscall entry points. { @[comm] = count(); } counts the calls and indexes them by the process name (comm).

Example Output:

@[bash]: 2500
@[sshd]: 1650
...

Run a Program from a File

Code:

sudo bpftrace /path/to/file

Motivation:

Running bpftrace programs from a file allows for more complex scripts to be written and maintained efficiently. This is particularly beneficial for recurring tasks or when dealing with lengthy and intricate tracing requirements, reducing the need to type long commands and making them easier to share with others.

Explanation:

• /path/to/file: This argument specifies the file path that contains a predefined bpftrace script.

Example Output:

The output would depend on what the script in the file is designed to do.

Trace a Program by PID

Code:

sudo bpftrace -e 'tracepoint:raw_syscalls:sys_enter /pid == 123/ { @[comm] = count(); }'

Motivation:

Tracing a specific program by its PID is valuable for diagnosing issues or monitoring performance exclusively for particular processes. By focusing on a single PID, the amount of data collected is reduced, making it easier to analyze the behavior of that process in isolation from others.

Explanation:

• /pid == 123/: This condition filters the trace to only include syscalls from the process with the PID 123.

Example Output:

@[process_name]: 100
...

Do a Dry Run and Display the Output in eBPF Format

Code:

sudo bpftrace -d -e '{one_line_program}'

Motivation:

Performing a dry run is a way to test bpftrace programs without actually executing them. This helps to ensure that the syntax and logic of the program are correct. Additionally, by converting the bpftrace script into the lower-level eBPF instructions, users can understand how their high-level tracers map to eBPF bytecode.

Explanation:

• -d: This flag is used to perform a dry run.
• -e '{one_line_program}': Executes the provided bpftrace script in a dry run, showing the generated eBPF code.

Example Output:

Program
1: (b7) r1 = 0
...

Conclusion

bpftrace is a versatile tool for advanced system monitoring and analysis on Linux. With its high-level language capabilities, it simplifies the process of creating custom probing and tracing functionalities. Whether querying for system call statistics, debugging performance bottlenecks, or ensuring system security, bpftrace provides a powerful platform for such endeavors. By walking through these examples, users can gain familiarity with different commands and adopt bpftrace in their system administration toolkit effectively.