The Power User's Swiss Army Knife
While BCC provides pre-made tools for known problems, bpftrace gives you a high-level scripting language to create your own custom tracing tools on the fly. Its syntax is deliberately simple — inspired by awk and the DTrace tool from Solaris — so you can write powerful one-liners without deep eBPF knowledge.
bpftrace is the tool you reach for when you have a specific, unusual question that no pre-built tool answers. It compiles your script to eBPF bytecode at runtime using LLVM.
Anatomy of a bpftrace One-Liner
A bpftrace script is built from three pieces: a probe — the hook you're attaching to, such as a kprobe on a specific kernel function (e.g., do_sys_openat2), which fires every time that function is called; an action block — the code that runs when the probe fires, typically a printf() call; and built-in variables available inside that block, like comm, which holds the name of the process that triggered the event.
Useful Built-in Variables
| Variable | Meaning |
|---|---|
comm |
Name of the current process |
pid |
Process ID |
tid |
Thread ID |
uid |
User ID of the process |
nsecs |
Current timestamp in nanoseconds |
args |
Arguments to the probed function |
retval |
Return value (in kretprobe/uretprobe) |
Practical One-Liners
The same probe-plus-action-block pattern scales to a wide range of ad hoc questions: which process is opening which files, how long read() syscalls take (aggregated into a latency histogram using bpftrace's built-in hist() function), which processes are generating the most syscalls overall, or when TCP connections are being established. Each is a single self-contained script built from the probe types and built-ins above — which is exactly why bpftrace is reached for one-off, exploratory questions rather than pre-packaged tools.
bpftrace vs. BCC: When to Use Which
| Situation | Use |
|---|---|
| Quick one-off investigation | bpftrace one-liner |
| Complex, reusable tool | BCC Python script |
| Pre-built tool exists for your problem | BCC tool directly |
| Need to aggregate data (histograms, counts) | Either — both support maps |
| Need to integrate with existing Python code | BCC |
Interviewers at companies running large Linux fleets (Netflix, Cloudflare, Meta) often ask: "How would you trace a specific kernel function without modifying the kernel or restarting the process?" The answer is bpftrace with a kprobe. Demonstrate you understand the probe types: kprobe for kernel functions, uprobe for user-space functions, tracepoint for stable kernel markers (preferred over kprobes when available, because they don't break across kernel versions).