threadsnoop(8) System Manager's Manual threadsnoop(8)

# [NAME](#NAME)

threadsnoop - Trace thread creation via pthread\_create(). Uses BCC/eBPF.

# [SYNOPSIS](#SYNOPSIS)

**threadsnoop**

# [DESCRIPTION](#DESCRIPTION)

threadsnoop traces calls to pthread\_create(), showing this path of thread creation. This can be used for workload characterization and discovery, and is a companion to [execsnoop(8)](/man/enterprise-packages/bcc/execsnoop.8) which traces [execve(2)](/man/enterprise-packages/bcc/execve.2).

This works by tracing the pthread\_create() from libpthread.so.0. The path to this library may need adjusting in the tool source to match your system.

Since this uses BPF, only the root user can use this tool.

# [REQUIREMENTS](#REQUIREMENTS)

CONFIG\_BPF and BCC.

# [EXAMPLES](#EXAMPLES)

[Trace calls pthread\_create():](#Trace)

\# **threadsnoop**

# [FIELDS](#FIELDS)

[TIME(ms)](#TIME%28ms%29)

Elapsed time since the tool began tracing (in milliseconds).

[PID](#PID)

The process ID.

[COMM](#COMM)

The process (thread) name.

[FUNC](#FUNC)

The name of the start routine, if the symbol is available, else a hex address for the start routine address.

# [OVERHEAD](#OVERHEAD)

Thread creation is expected to be low (<< 1000/s), so the overhead of this tool is expected to be negligible.

# [SOURCE](#SOURCE)

This originated as a bpftrace tool from the book "BPF Performance Tools", published by Addison Wesley (2019):

http://www.brendangregg.com/bpf-performance-tools-book.html

See the book for more documentation on this tool.

This version is in the BCC repository:

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

# [OS](#OS)

Linux

# [STABILITY](#STABILITY)

Unstable - in development.

# [AUTHOR](#AUTHOR)

Brendan Gregg

# [SEE ALSO](#SEE_ALSO)

[execsnoop(8)](/man/enterprise-packages/bcc/execsnoop.8)

2019-07-02 USER COMMANDS

---

Document: threadsnoop(8) from bcc 0.37.0-r3 (Chainguard OS)
Source: https://github.com/iovisor/bcc