Projects sharing features with Perf Tools

bpftrace is a dynamic instrumentation tool and high-level tracing language for eBPF. It functions as a Linux kernel tracer and user-space profiler used to analyze live software behavior through the on-the-fly insertion of tracing and logging probes. The tool enables the collection of real-time data from the Linux kernel and applications to diagnose issues on live production systems. It intercepts user-level events using uprobes and USDT to debug and profile applications without modifying the original source code. The project covers system observability and performance analysis by monitoring

Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments. It functions as a security policy manager, observability agent, and enforcement engine that hooks into kernel functions and tracepoints to detect privilege escalation, container escapes, and unauthorized system activity. The project distinguishes itself through its ability to perform real-time, in-kernel enforcement, allowing it to synchronously terminate malicious processes or modify function return values before a system call completes. It provides deep Kubernetes integration

Perfetto is a platform for system-level performance tracing and analysis on Linux and Android. It combines a high-throughput trace recorder, a SQL-based query engine, and a browser-based visualizer into a single toolchain. The platform covers CPU scheduling and call-stack profiling, native and Java heap memory allocation tracking, GPU and graphics events, and system-wide counters such as CPU frequency and power consumption. The architecture decouples trace recording from offline analysis, using a compact protobuf format for event encoding and columnar storage for efficient SQL queries. The we

Sysdig is a Linux system observability tool and kernel event analyzer designed for capturing and analyzing kernel-level system calls and operating system events. It functions as a system call tracer and container security monitor, providing deep visibility into the activity of machines, virtual machines, and containers. The project specializes in non-invasive container inspection, allowing for the monitoring of container activity and resource usage without modifying the container environment or adding instrumentation. It enables the recording of detailed system traces into binary files for re

This project is an educational resource providing a comprehensive development tutorial for writing and loading eBPF programs using C, Go, and Rust within the Linux kernel. It serves as a technical guide for developing custom logic to execute directly in the kernel. The materials cover specialized domains including kernel observability and tracing, security implementation for intrusion detection, and high-performance network engineering for packet filtering and load balancing. It also includes dedicated manuals for Linux kernel tracing and the use of kprobes, uprobes, and tracepoints. The pro

Falco is an eBPF runtime security monitor and cloud native detection engine that identifies abnormal behavior and security threats across hosts and containers. It functions as a Linux kernel event auditor, capturing system calls and kernel events in real-time to detect malicious activity. The system distinguishes itself through a rule-based threat detection model that evaluates system activity against a library of community-maintained rules and custom security definitions. It enriches raw kernel events with container and Kubernetes metadata to provide observability into isolated environments

The Linux kernel is a monolithic operating system core that manages hardware resources, memory, and process scheduling across diverse computing architectures. It provides a standardized, POSIX-compliant environment for application execution while maintaining a modular driver framework that allows for the dynamic loading and removal of hardware interfaces. The project is distinguished by its high-performance concurrency toolkit, which utilizes lockless synchronization primitives and read-copy-update mechanisms to manage shared data access in multi-core environments. It incorporates a comprehen

Inspektor Gadget is an eBPF observability toolset and program framework designed for tracing Linux systems and debugging Kubernetes nodes. It provides a suite of tools to collect kernel-level telemetry and export system metrics via the OpenTelemetry standard. The project distinguishes itself by packaging inspection tools as OCI-compliant container images, allowing for standardized distribution and deployment across clusters and hosts. It employs a modular data processing pipeline that utilizes WebAssembly modules to transform and filter telemetry, and leverages Compile Once Run Everywhere for

Pyroscope is a continuous profiling platform designed to collect, store, and visualize application performance data. It functions as an application performance management suite that tracks historical resource usage to identify bottlenecks and detect performance regressions over time. The platform distinguishes itself through its use of kernel-level instrumentation and dynamic runtime hooks, which allow for performance monitoring without requiring manual code modifications or application restarts. It employs a sidecar agent architecture to offload telemetry processing, utilizing delta-encoded

The diagnostics project provides a cross-platform diagnostic infrastructure and command-line toolkit for monitoring runtime performance, analyzing memory dumps, and troubleshooting applications. It features a custom inter-process communication protocol for command and telemetry exchange across platforms, a low-overhead event pipe mechanism for streaming real-time diagnostic events and performance counters from running processes, and automated remote symbol resolution for stack trace analysis. The platform includes native debugger extensions that integrate with standard debuggers to inspect ma

ethr is a command line network diagnostic tool and performance analyzer designed to measure throughput, latency, and packet loss across TCP, UDP, and ICMP protocols. It functions as a multi-threaded network throughput tester and a diagnostic utility for analyzing connection health between client and server endpoints. The project differentiates itself through specialized diagnostics such as TCP retransmission monitoring and bidirectional path analysis to identify asymmetric performance differences. It provides the ability to evaluate the overhead of encrypted HTTPS connections and enforce spec

gperftools is a collection of specialized tools for profiling CPU usage, detecting memory errors, and providing high-performance memory allocation. It provides a memory profiling toolkit for C++ applications, including a sampling CPU profiler and a heap profiler for analyzing consumption patterns. The project includes a high-performance memory allocator designed as a multi-threaded replacement for standard allocation to reduce contention and improve execution speed. It further provides a memory debugger to identify illegal memory access and double frees. The toolkit covers broad diagnostic c

strace is a diagnostic, debugging and instructional userspace utility for Linux

Hexyl is a colored hex dump utility and binary data viewer for the terminal. It allows for the inspection of binary files by rendering contents as a colored hex dump to distinguish between different byte categories, such as printable text, whitespace, and null bytes. The tool includes a C-style hex exporter that transforms binary data into C include files for direct integration into source code. It supports visual layout customization through configurable panels and borders, as well as the ability to define colors for byte categories and offsets using terminal colors or RGB hex codes via envi

Bashtop is a terminal-based system monitor and resource dashboard for Unix systems, including Linux, macOS, and FreeBSD. It provides a text-user interface for tracking real-time hardware performance and managing system processes. The tool functions as a hardware dashboard that visualizes processor, memory, disk, and network usage. It includes process management capabilities that allow users to filter, sort, and terminate active system tasks directly from the command line. Users can customize the visual appearance and behavior of the monitor through integrated menus or local configuration fil

Binsider is a collection of specialized toolsets for hexadecimal editing, ELF structural analysis, system call tracing, and execution performance profiling. It provides a suite of utilities designed for binary reverse engineering, encompassing both static structural analysis and dynamic runtime monitoring of compiled binaries. The project distinguishes itself by combining low-level binary manipulation, such as a hex editor for raw byte modification, with an ELF binary analysis tool for inspecting file structures and metadata. It also includes a Linux system call tracer for observing dynamic b

ProcMon-for-Linux is an eBPF-based system observability tool and process monitor for Linux. It functions as a system call tracer and activity logger, capturing real-time kernel and user-space events to analyze operating system behavior. The project features a text user interface for inspecting recorded trace files. It separates high-performance headless event recording from the analysis interface to prevent data loss during heavy system loads. The tool provides capabilities for system call tracing and activity monitoring, including the ability to filter events by process identifiers or speci

Hotspot is a graphical user interface for analyzing and visualizing performance data captured by the Linux perf tool. It functions as a performance profiling visualizer and assembly-level profiler that maps performance costs to specific instructions synchronized with original source code. The project distinguishes itself through a remote symbol resolver that maps performance data from embedded targets to local host debug symbols and sysroots. It also includes a specialized off-CPU analysis tool designed to identify thread wait times and I/O blocks using kernel scheduler tracepoints. The tool

This project is a Linux system administration question bank designed to evaluate knowledge of server management. It serves as a technical reference and study guide through a collection of curated questions and answers. The resource provides targeted preparation for technical interviews and professional exams. It specifically covers DevOps interview preparation, including containerization, continuous integration, and version control. The knowledge base spans several core competency areas, including system internals, kernel architectures, and the Linux boot process. It also includes materials

VizTracer is a Python runtime instrumentation system and execution profiler used to trace and visualize code execution. It functions as a multi-process performance analyzer and trace visualizer, providing an interactive timeline and flamegraph interface to identify performance bottlenecks and analyze call sequences. The project distinguishes itself by its ability to aggregate execution data from multiple threads, subprocesses, and asynchronous tasks into a single unified report. It also features live process instrumentation, allowing users to attach to and detach from running Python applicati

Blink is a JIT-based instruction emulator and x86-64 Linux emulator designed to run Linux binaries and ELF files across different host operating systems and architectures. It functions as a binary execution sandbox and system call simulator, providing a controlled environment for running programs. The project distinguishes itself with a terminal user interface for monitoring execution, managing breakpoints, and visualizing JIT compilation paths. It supports self-modifying code through a cache-invalidating memory model and provides execution environment isolation using restricted directory ove

The Windows Exporter is a service that collects system, performance, and hardware metrics from Windows servers and exposes them via a text-based HTTP endpoint for Prometheus to scrape. It functions as a system metrics collector and service monitor designed to provide observability across Windows environments. The project utilizes a modular collector design that gathers data through Windows Management Instrumentation, native performance counters, and registry keys. It also includes a text-file metrics importer that allows user-defined or third-party business metrics to be read from local plain

The Missing Semester is a free, open-source educational curriculum designed to bridge the gap between theoretical computer science and the practical tooling every software engineer needs. Organized as a structured course, it covers Unix shell mastery, version control with Git, software debugging and profiling, system administration fundamentals, and computer security practices — the skills often left out of traditional degree programs. The project is maintained as a collaborative set of lecture notes, exercises, and guides that function as both a professional development tools course and a Uni

nextest is a high-performance test execution framework and Rust test runner designed to manage parallelism, retries, and timeouts. It serves as a test recording system that captures execution metadata and outputs into archives for later failure analysis and replay. The project distinguishes itself as a flakiness detection tool, identifying unstable tests through stress loops and automated retry policies. It also functions as a CI test orchestrator, capable of partitioning test suites across multiple workers and exporting results in standardized JUnit XML and JSON formats. The framework provi

cAdvisor is a container resource monitoring agent and performance analyzer that collects and exports CPU, memory, network, and disk usage statistics from running containers. It functions as a telemetry tool for discovering containers across various runtimes and serves as a Prometheus-compatible metrics exporter. The agent distinguishes itself by analyzing Linux control groups to provide visibility into resource consumption and limits. It utilizes kernel perf events and NUMA statistics for low-level hardware performance tracking and diagnostics, and it can identify out-of-memory kill events th

This project is a comprehensive educational resource and curriculum focused on site reliability engineering, distributed systems, and infrastructure operations. It provides technical guides, a systems engineering course, and instructional manuals designed to teach the principles of managing large-scale computing environments. The curriculum covers high-level architectural design for scalability and resilience, including fault-tolerant infrastructure, high-availability patterns, and microservices decomposition. It emphasizes the practical application of site reliability engineering through the

htop is a terminal-based system resource monitor and interactive process viewer. It functions as a text-user interface dashboard for overseeing hardware temperatures, load averages, and battery status while providing a comprehensive tool for monitoring and managing system processes. The application distinguishes itself through detailed process lifecycle management, allowing users to kill processes, adjust priorities via renicing, and assign CPU affinity to specific cores. It provides high-level visibility into system behavior through process hierarchy visualization and the ability to inspect