threadsnoop.bt(8) System Manager's Manual threadsnoop.bt(8)

# [NAME](#NAME)

threadsnoop.bt - Trace thread creation via pthread\_create(). Uses bpftrace/eBPF.

# [SYNOPSIS](#SYNOPSIS)

**threadsnoop.bt**

# [DESCRIPTION](#DESCRIPTION)

threadsnoop traces calls to pthread\_create(), showing this path of thread creation. This can be used for workload characterization and discovery, and is a companion to [execsnoop.bt(8)](/man/enterprise-packages/bpftrace/execsnoop.bt.8) which traces [execve(2)](/man/enterprise-packages/bpftrace/execve.2).

This works by tracing the pthread\_create() from libpthread.so.0. The path to this library may need adjusting in the tool source to match your system.

Since this uses BPF, only the root user can use this tool.

# [REQUIREMENTS](#REQUIREMENTS)

CONFIG\_BPF and bpftrace.

# [EXAMPLES](#EXAMPLES)

[Trace calls pthread\_create():](#Trace)

\# **threadsnoop.bt**

# [FIELDS](#FIELDS)

[TIME(ms)](#TIME%28ms%29)

Elapsed time since the tool began tracing (in milliseconds).

[PID](#PID)

The process ID.

[COMM](#COMM)

The process (thread) name.

[FUNC](#FUNC)

The name of the start routine, if the symbol is available, else a hex address for the start routine address.

# [OVERHEAD](#OVERHEAD)

Thread creation is expected to be low (<< 1000/s), so the overhead of this tool is expected to be negligible.

# [SOURCE](#SOURCE)

This tool originated from the book "BPF Performance Tools", published by Addison Wesley (2019):

http://www.brendangregg.com/bpf-performance-tools-book.html

See the book for more documentation on this tool.

This version is in the bpftrace repository:

https://github.com/bpftrace/bpftrace

Also look in the bpftrace distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

# [OS](#OS)

Linux

# [STABILITY](#STABILITY)

Unstable - in development.

# [AUTHOR](#AUTHOR)

Brendan Gregg

# [SEE ALSO](#SEE_ALSO)

[execsnoop.bt(8)](/man/enterprise-packages/bpftrace/execsnoop.bt.8)

2019-07-02 USER COMMANDS

---

Document: threadsnoop.bt(8) from bpftrace 0.27.1-r0 (Chainguard OS)
Source: https://github.com/bpftrace/bpftrace