Package bcc-tools

• bcc-argdist(8) — Trace a function and display a histogram or frequency count of its parameter values. Uses Linux eBPF/bcc.
• bcc-bashreadline(8) — Print entered bash commands system wide. Uses Linux eBPF/bcc.
• bcc-bindsnoop(8) — Trace bind() system calls.
• bcc-biolatency(8) — Summarize block device I/O latency as a histogram.
• bcc-biolatpcts(8) — Monitor IO latency distribution of a block device.
• bcc-biopattern(8) — Identify random/sequential disk access patterns.
• bcc-biosnoop(8) — Trace block device I/O and print details incl. issuing PID.
• bcc-biotop(8) — Block device (disk) I/O by process top.
• bcc-bitesize(8) — Summarize block device I/O size as a histogram \- Linux eBPF/bcc.
• bcc-bpflist(8) — Display processes currently using BPF programs and maps.
• bcc-bps(8) — List all BPF programs. 'ps' for BPF programs.
• bcc-btrfsdist(8) — Summarize btrfs operation latency. Uses Linux eBPF/bcc.
• bcc-btrfsslower(8) — Trace slow btrfs file operations, with per-event details.
• bcc-cachestat(8) — Statistics for linux page cache hit/miss ratios. Uses Linux eBPF/bcc.
• bcc-cachetop(8) — Statistics for linux page cache hit/miss ratios per processes. Uses Linux eBPF/bcc.
• bcc-capable(8) — Trace security capability checks (cap_capable()).
• bcc-cobjnew(8) — Summarize object allocations in
• bcc-compactsnoop(8) — Trace compact zone events. Uses Linux eBPF/bcc.
• bcc-cpudist(8) — On- and off-CPU task time as a histogram.
• bcc-cpuunclaimed(8) — Sample CPU run queues and calculate unclaimed idle CPU. Uses Linux eBPF/bcc.
• bcc-criticalstat(8) — A tracer to find and report long atomic critical sections in kernel
• bcc-cthreads(8) — Trace thread creation events in Java or pthreads.
• bcc-dbslower(8) — Trace MySQL/PostgreSQL server queries slower than a threshold.
• bcc-dbstat(8) — Collect histograms of MySQL/PostgreSQL query latencies.
• bcc-dcsnoop(8) — Trace directory entry cache (dcache) lookups. Uses Linux eBPF/bcc.
• bcc-dcstat(8) — Directory entry cache (dcache) stats. Uses Linux eBPF/bcc.
• bcc-deadlock(8) — Find potential deadlocks (lock order inversions)
• bcc-dirtop(8) — File reads and writes by directory. Top for directories.
• bcc-drsnoop(8) — Trace direct reclaim events. Uses Linux eBPF/bcc.
• bcc-execsnoop(8) — Trace new processes via exec() syscalls. Uses Linux eBPF/bcc.
• bcc-exitsnoop(8) — Trace all process termination (exit, fatal signal). Uses Linux eBPF/bcc.
• bcc-ext4dist(8) — Summarize ext4 operation latency. Uses Linux eBPF/bcc.
• bcc-ext4slower(8) — Trace slow ext4 file operations, with per-event details.
• bcc-f2fsslower(8) — Trace slow f2fs file operations, with per-event details.
• bcc-filegone(8) — Trace why file gone (deleted or renamed). Uses Linux eBPF/bcc.
• bcc-filelife(8) — Trace the lifespan of short-lived files. Uses Linux eBPF/bcc.
• bcc-fileslower(8) — Trace slow synchronous file reads and writes.
• bcc-filetop(8) — File reads and writes by filename and process. Top for files.
• bcc-funccount(8) — Count function, tracepoint, and USDT probe calls matching a pattern. Uses Linux eBPF/bcc.
• bcc-funcinterval(8) — Time interval between the same function, tracepoint as a histogram.
• bcc-funclatency(8) — Time functions and print latency as a histogram.
• bcc-funcslower(8) — Trace slow kernel or user function calls.
• bcc-gethostlatency(8) — Show latency for getaddrinfo/gethostbyname[2] calls. Uses Linux eBPF/bcc.
• bcc-hardirqs(8) — Measure hard IRQ (hard interrupt) event time. Uses Linux eBPF/bcc.
• bcc-inject(8) — injects appropriate error into function if input call chain and
• bcc-javacalls(8) — Summarize method calls
• bcc-javaflow(8) — Print a flow graph of method
• bcc-javagc(8) — Trace garbage collection events in
• bcc-javaobjnew(8) — Summarize object allocations in
• bcc-javastat(8) — Activity stats from
• bcc-javathreads(8) — Trace thread creation events in Java or pthreads.
• bcc-killsnoop(8) — Trace signals issued by the kill() syscall. Uses Linux eBPF/bcc.
• bcc-klockstat(8) — Traces kernel mutex lock events and display locks statistics. Uses Linux eBPF/bcc.
• bcc-ksnoop(8) — tool for tracing kernel function entry/return showing arguments/return values
• bcc-kvmexit(8) — Display the exit_reason and its statistics of each vm exit.
• bcc-llcstat(8) — Summarize CPU cache references and misses by process. Uses Linux eBPF/bcc.
• bcc-mdflush(8) — Trace md flush events. Uses Linux eBPF/bcc.
• bcc-memleak(8) — Print a summary of outstanding allocations and their call stacks to detect memory leaks. Uses Linux eBPF/bcc.
• bcc-mountsnoop(8) — Trace mount() and umount() syscalls. Uses Linux eBPF/bcc.
• bcc-mysqld_qslower(8) — Trace MySQL server queries slower than a threshold.
• bcc-netqtop(8) — Summarize PPS, BPS, average size of packets and packet counts ordered by packet sizes
• bcc-nfsdist(8) — Summarize NFS operation latency. Uses Linux eBPF/bcc.
• bcc-nfsslower(8) — Trace slow NFS file operations, with per-event details.
• bcc-nodegc(8) — Trace garbage collection events in
• bcc-nodestat(8) — Activity stats from
• bcc-numasched(8) — Tracing task switch NUMA. Uses bcc/eBPF.
• bcc-offcputime(8) — Summarize off-CPU time by kernel stack trace. Uses Linux eBPF/bcc.
• bcc-offwaketime(8) — Summarize blocked time by off-CPU stack + waker stack. Uses Linux eBPF/bcc.
• bcc-oomkill(8) — Trace oom_kill_process(). Uses Linux eBPF/bcc.
• bcc-opensnoop(8) — Trace open() syscalls. Uses Linux eBPF/bcc.
• bcc-perlcalls(8) — Summarize method calls
• bcc-perlflow(8) — Print a flow graph of method
• bcc-perlstat(8) — Activity stats from
• bcc-phpcalls(8) — Summarize method calls
• bcc-phpflow(8) — Print a flow graph of method
• bcc-phpstat(8) — Activity stats from
• bcc-pidpersec(8) — Count new processes (via fork()). Uses Linux eBPF/bcc.
• bcc-ppchcalls(8) — Summarize ppc hcall counts and latencies.
• bcc-profile(8) — Profile CPU usage by sampling stack traces. Uses Linux eBPF/bcc.
• bcc-pythoncalls(8) — Summarize method calls
• bcc-pythonflow(8) — Print a flow graph of method
• bcc-pythongc(8) — Trace garbage collection events in
• bcc-pythonstat(8) — Activity stats from
• bcc-rdmaucma(8) — Trace RDMA Userspace Connection Manager Access Event. For Linux, uses BCC, eBPF.
• bcc-readahead(8) — Show performance of read-ahead cache
• bcc-reset-trace(8) — reset the state of tracing.
• bcc-rubycalls(8) — Summarize method calls
• bcc-rubyflow(8) — Print a flow graph of method
• bcc-rubygc(8) — Trace garbage collection events in
• bcc-rubyobjnew(8) — Summarize object allocations in
• bcc-rubystat(8) — Activity stats from
• bcc-runqlat(8) — Run queue (scheduler) latency as a histogram.
• bcc-runqlen(8) — Scheduler run queue length as a histogram.
• bcc-runqslower(8) — Trace long process scheduling delays.
• bcc-shmsnoop(8) — Trace System V shared memory syscalls. Uses Linux eBPF/bcc.
• bcc-slabratetop(8) — Kernel SLAB/SLUB memory cache allocation rate top.
• bcc-sofdsnoop(8) — traces FDs passed by sockets
• bcc-softirqs(8) — Measure soft IRQ (soft interrupt) event time. Uses Linux eBPF/bcc.
• bcc-softirqslower(8) — Trace softirq handlers with latency exceeding a threshold
• bcc-solisten(8) — Trace listening socket
• bcc-spfdsnoop(8) — Trace FDs passed through unix sockets. Uses Linux eBPF/bcc.
• bcc-sslsniff(8) — Print data passed to OpenSSL, GnuTLS or NSS. Uses Linux eBPF/bcc.
• bcc-stackcount(8) — Count function calls and their stack traces. Uses Linux eBPF/bcc.
• bcc-statsnoop(8) — Trace stat() syscalls. Uses Linux eBPF/bcc.
• bcc-swapin(8) — Count swapins by process. Uses BCC/eBPF.
• bcc-syncsnoop(8) — Trace sync() syscall. Uses Linux eBPF/bcc.
• bcc-syscount(8) — Summarize syscall counts and latencies.
• bcc-tclcalls(8) — Summarize method calls
• bcc-tclflow(8) — Print a flow graph of method
• bcc-tclobjnew(8) — Summarize object allocations in
• bcc-tclstat(8) — Activity stats from
• bcc-tcpaccept(8) — Trace TCP passive connections (accept()). Uses Linux eBPF/bcc.
• bcc-tcpcong(8) — Measure tcp congestion state duration. Uses Linux eBPF/bcc.
• bcc-tcpconnect(8) — Trace TCP active connections (connect()). Uses Linux eBPF/bcc.
• bcc-tcpconnlat(8) — Trace TCP active connection latency. Uses Linux eBPF/bcc.
• bcc-tcpdrop(8) — Trace kernel-based TCP packet drops with details. Uses Linux eBPF/bcc.
• bcc-tcplife(8) — Trace TCP sessions and summarize lifespan. Uses Linux eBPF/bcc.
• bcc-tcpretrans(8) — Trace or count TCP retransmits and TLPs. Uses Linux eBPF/bcc.
• bcc-tcprtt(8) — Trace TCP RTT of established connections. Uses Linux eBPF/bcc.
• bcc-tcpstates(8) — Trace TCP session state changes with durations. Uses Linux eBPF/bcc.
• bcc-tcpsubnet(8) — Summarize and aggregate IPv4 TCP traffic by subnet.
• bcc-tcpsynbl(8) — Show the TCP SYN backlog as a histogram. Uses BCC/eBPF.
• bcc-tcptop(8) — Summarize TCP send/recv throughput by host. Top for TCP.
• bcc-tcptracer(8) — Trace TCP established connections. Uses Linux eBPF/bcc.
• bcc-threadsnoop(8) — Trace thread creation via pthread_create(). Uses BCC/eBPF.
• bcc-tplist(8) — Display kernel tracepoints or USDT probes and their formats.
• bcc-trace(8) — Trace a function and print its arguments or return value, optionally evaluating a filter. Uses Linux eBPF/bcc.
• bcc-ttysnoop(8) — Watch output from a tty or pts device. Uses Linux eBPF/bcc.
• bcc-ucalls(8) — Summarize method calls
• bcc-uflow(8) — Print a flow graph of method
• bcc-ugc(8) — Trace garbage collection events in
• bcc-uobjnew(8) — Summarize object allocations in
• bcc-ustat(8) — Activity stats from
• bcc-uthreads(8) — Trace thread creation events in Java or pthreads.
• bcc-vfscount(8) — Count VFS calls (vfs_*). Uses Linux eBPF/bcc.
• bcc-vfsstat(8) — Statistics for some common VFS calls. Uses Linux eBPF/bcc.
• bcc-virtiostat(8) — Trace VIRTIO devices input/output statistics. Uses Linux eBPF/bcc.
• bcc-wakeuptime(8) — Summarize sleep to wakeup time by waker kernel stack. Uses Linux eBPF/bcc.
• bcc-wqlat(8) — Summarize kernel workqueue latency as a histogram.
• bcc-xfsdist(8) — Summarize XFS operation latency. Uses Linux eBPF/bcc.
• bcc-xfsslower(8) — Trace slow xfs file operations, with per-event details.
• bcc-zfsdist(8) — Summarize ZFS operation latency. Uses Linux eBPF/bcc.
• bcc-zfsslower(8) — Trace slow zfs file operations, with per-event details.