bpftrace.org

What It Is

bpftrace is a dynamic tracing tool for Linux. It uses LLVM as its backend to compile bpftrace scripts into eBPF bytecode, and interacts with the Linux BPF subsystem through libbpf, bcc, and existing Linux tracing facilities such as kprobes, uprobes, and tracepoints. Its language is inspired by awk, C, DTrace, and SystemTap, and it is positioned more as a programmable system-level observability tool than an application APM solution.

Core Capabilities

In terms of functionality, bpftrace is well suited for tracing system calls, kernel functions, user-space functions, tracepoint events, cgroups, CPU and process information, stack data, and map statistics. The documentation covers language features such as action blocks, predicates, argument access, arrays, conditionals, loops, config blocks, imports, and standard-library helpers. It also supports importing .bt, .h, and .bpf.c files. Its API surface mainly consists of the scripting language, standard library, command-line options, environment variables, and runtime modes; it does not provide a traditional SaaS API or multi-language SDK.

Pricing and Deployment

The collected text does not mention commercial pricing, paid editions, or enterprise support. Given the presence of GitHub, How to Contribute, community forums, and similar entry points, it appears to be an open-source community tool; however, the page content does not explicitly state the project license. Deployment is as a local Linux command-line tool rather than a cloud-hosted service, so it naturally supports running on self-owned servers or in production environments.

Pros and Cons

Its strengths are low-level capability, relatively controllable overhead, and probe coverage across both kernel and user space, making it suitable for complex performance issues and difficult production troubleshooting. The documentation is well organized by language, standard library, and command line, and preserves materials for multiple versions, giving it generally high quality. The downsides are a clear learning curve: users need to understand Linux, eBPF, probes, kernel types, and permissions. Some capabilities depend on BTF, architecture, or build options; features such as DWARF user stacks are still marked as unstable, and BPF does not support floating point.

Who It’s For and Access from China

bpftrace is best suited for SREs, kernel engineers, performance analysts, security researchers, and platform teams working on deep Linux observability, system call tracing, and production incident diagnosis. For regular application developers who only need logs, metrics, and distributed tracing, alternatives such as OpenTelemetry, Prometheus, APM tools, or perf/ftrace may be better starting points. The collected text does not describe accessibility from China. Availability of bpftrace.org and GitHub-related resources may depend on the network environment and should be tested in practice. Payments are not relevant.