bpftrace - a high-level tracing language for Linux powered by BPF

USAGE:
    bpftrace [options] filename
    bpftrace [options] - <stdin input>
    bpftrace [options] -e 'program'
    use -- after filename/-e 'program' for named script parameters

OPTIONS:
    -e 'program'   execute this program
    -l, --list [search|filename]
                   list kernel probes or probes in a program
    -v, --verbose  enable verbose messages; with -l, also show probe arguments
    -h, --help     show this help message
    -V, --version  bpftrace version
    --info         print information about kernel BPF support

    -p, --pid PID  filter actions and enable USDT probes on PID
    -c, --cmd CMD  run CMD and enable USDT probes on resulting process
    --dwarf-pid PID
                   add additional pids to the DWARF-unwinder
    --usdt-file-activation
                   activate usdt semaphores based on file path

    -o, --output FILE
                   redirect bpftrace output to FILE
    -f FORMAT      output format ('text', 'json')
    -B MODE        output buffering mode ('line', 'full', 'none')
    -q, --quiet    keep messages quiet
    -k, --warnings emit a warning when probe read helpers return an error
    --no-warnings  disable all warning messages

    -I DIR         add the directory to the include search path
    --include FILE add an #include file before preprocessing
    --debuginfo DIR[:DIR]
                   add directories to the debug info search path
    --traceable-functions FILE
                   load the list of traceable kernel functions from FILE

    --unsafe       allow unsafe/destructive functionality
    --no-feature FEATURE[,FEATURE]
                   disable use of detected features

DEVELOPER OPTIONS:
    --mode MODE    used for benchmarking and testing
                   ('codegen', 'compiler-bench', 'bench', 'test', 'format')
    --test         run all test: probes (same as --mode test)
    --bench        run all bench: probes (same as --mode bench)
    --probe-filter REGEX
                   only run probes whose name matches REGEX
    --fmt          format the input script and print it

TROUBLESHOOTING OPTIONS:
    --dry-run      terminate execution right after attaching all the probes
    --verify-llvm-ir
                   check that the generated LLVM IR is valid
    -d, --debug STAGE
                   debug info for various stages of bpftrace execution
                   ('all', 'ast', 'types', 'codegen', 'codegen-opt', 'libbpf', 'verifier')
                   ('parse', 'dis') - available on debug builds
    --emit-elf FILE
                   (dry run) generate ELF file with bpf programs and write to FILE
    --emit-llvm FILE
                   write LLVM IR to FILE.original.ll and FILE.optimized.ll

CONFIGURATION:
    bpftrace also supports environment variables and config options
    for tuning behavior. See 'man bpftrace' or the online documentation
    for the full list.

EXAMPLES:
    bpftrace -e 'kprobe:do_nanosleep { printf("PID %d sleeping...\n", pid); }'
        trace processes calling sleep
    bpftrace -e 'tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }'
        count syscalls by process name
    bpftrace -e 'tracepoint:syscalls:sys_enter_openat { printf("%s %s\n", comm, str(args.filename)); }'
        trace file opens with process name and path
    bpftrace -e 'profile:hz:99 { @[kstack] = count(); }'
        profile kernel stacks at 99 Hertz
    bpftrace -e 'tracepoint:block:block_rq_issue { @ = hist(args.bytes); }'
        histogram of block I/O request sizes
    bpftrace -p 1337 -e 'uprobe:/usr/lib/libc.so.6:malloc { @[ustack] = count(); }'
        count malloc calls by user stack for a specific process
    bpftrace -l '*sleep*'
        list probes containing "sleep"
    bpftrace -lv 'kprobe:do_nanosleep'
        show the arguments for the do_nanosleep kprobe

DOCUMENTATION:
    https://bpftrace.org
    https://github.com/bpftrace/bpftrace