liushuyu/bpftrace

bpftrace is a tool that lets you write short, simple scripts to observe what's happening inside a running Linux system. Instead of guessing why a server is slow or which program is opening too many files, you can use it to get real-time answers. It is designed to be approachable: you can answer complex questions with one-line commands, similar to how you might use a quick spreadsheet formula. At a high level, when you write a script, the tool compiles it down to a safe, low-level format that the Linux kernel can run directly. It hooks into existing Linux tracing capabilities to monitor things like system calls (the requests programs make to the kernel), disk activity, and even hardware events like cache misses. The scripting language itself is inspired by familiar tools like awk and C, making it relatively easy to pick up if you have seen either of those. The primary users are system administrators, site reliability engineers, and developers working on Linux servers. For example, if a production database is suddenly slow, an engineer could use this tool to count how many disk read requests each running program is making per second. Another user might want to trace which files a specific application is opening, or profile a program's code to find exactly which function is consuming the most CPU. It essentially acts as a safe, live debugging X-ray for Linux. The project is notable for making a very powerful, kernel-level tracing technology accessible through a high-level language. Writing custom kernel probes is traditionally difficult and risky, but this tool provides a safe, simplified layer on top. It also comes with editor plugins for VS Code, Vim, and Emacs, which helps users write and validate their tracing scripts more easily.