detailyang/bcc

BCC is a toolkit that lets you watch what's happening inside a Linux system at a very deep level, not just what your applications are doing, but what the operating system itself is doing with disk reads, network connections, memory, process scheduling, and more. It's built around a Linux feature called eBPF, which lets you run small, sandboxed programs inside the kernel that can observe activity in real time without crashing or slowing the system down. The collection ships with dozens of ready-to-use tools. For example, you can trace every TCP connection your server makes, see a histogram of how long disk reads take, detect memory leaks in a running process, find slow MySQL or PostgreSQL queries, watch for short-lived files, or trace which processes are triggering out-of-memory kills. One included tool watches disk I/O and prints a histogram showing how many reads fell into each size bucket, so you can immediately see whether your workload is dominated by small or large transfers. Everything you trace can be customized or extended. The main audience is systems engineers, site reliability engineers, and developers running production Linux infrastructure who need to diagnose performance problems or understand system behavior that standard monitoring tools can't surface. If you're debugging why a server is slow and top or htop aren't giving you enough detail, these tools can tell you exactly which syscalls are slow, which kernel functions are hot, or where packets are getting dropped. BCC makes eBPF programs approachable by letting you write the kernel-side instrumentation in C and the user-facing logic in Python. The key tradeoff is that it only works on Linux kernel 4.1 and above, and many features require an even newer kernel. You also need root privileges, since these tools operate at the kernel level. That's inherent to what they do, you're inspecting the deepest layers of the operating system.