Open-source alternatives to Bpftrace

bpftrace is a dynamic instrumentation tool and high-level tracing language for eBPF. It functions as a Linux kernel tracer and user-space profiler used to analyze live software behavior through the on-the-fly insertion of tracing and logging probes. The tool enables the collection of real-time data from the Linux kernel and applications to diagnose issues on live production systems. It intercepts user-level events using uprobes and USDT to debug and profile applications without modifying the original source code. The project covers system observability and performance analysis by monitoring

This project is an educational resource providing a comprehensive development tutorial for writing and loading eBPF programs using C, Go, and Rust within the Linux kernel. It serves as a technical guide for developing custom logic to execute directly in the kernel. The materials cover specialized domains including kernel observability and tracing, security implementation for intrusion detection, and high-performance network engineering for packet filtering and load balancing. It also includes dedicated manuals for Linux kernel tracing and the use of kprobes, uprobes, and tracepoints. The pro

This project is a Go library and runtime for loading and managing eBPF programs and maps. It provides a bytecode loader and kernel interface to inject instructions into kernel hooks for system-level execution and observability across both Linux and Windows operating systems. The library features a relocation engine and tooling to ensure program compatibility across different kernel versions and distributions. It supports portable deployment by embedding compiled objects for multiple CPU architectures into a single binary and provides the ability to load signed system drivers on Windows. The

The Linux kernel is a monolithic operating system core that manages hardware resources, memory, and process scheduling across diverse computing architectures. It provides a standardized, POSIX-compliant environment for application execution while maintaining a modular driver framework that allows for the dynamic loading and removal of hardware interfaces. The project is distinguished by its high-performance concurrency toolkit, which utilizes lockless synchronization primitives and read-copy-update mechanisms to manage shared data access in multi-core environments. It incorporates a comprehen

Inspektor Gadget is an eBPF observability toolset and program framework designed for tracing Linux systems and debugging Kubernetes nodes. It provides a suite of tools to collect kernel-level telemetry and export system metrics via the OpenTelemetry standard. The project distinguishes itself by packaging inspection tools as OCI-compliant container images, allowing for standardized distribution and deployment across clusters and hosts. It employs a modular data processing pipeline that utilizes WebAssembly modules to transform and filter telemetry, and leverages Compile Once Run Everywhere for

Falco is an eBPF runtime security monitor and cloud native detection engine that identifies abnormal behavior and security threats across hosts and containers. It functions as a Linux kernel event auditor, capturing system calls and kernel events in real-time to detect malicious activity. The system distinguishes itself through a rule-based threat detection model that evaluates system activity against a library of community-maintained rules and custom security definitions. It enriches raw kernel events with container and Kubernetes metadata to provide observability into isolated environments

Pyroscope is a continuous profiling platform designed to collect, store, and visualize application performance data. It functions as an application performance management suite that tracks historical resource usage to identify bottlenecks and detect performance regressions over time. The platform distinguishes itself through its use of kernel-level instrumentation and dynamic runtime hooks, which allow for performance monitoring without requiring manual code modifications or application restarts. It employs a sidecar agent architecture to offload telemetry processing, utilizing delta-encoded

Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments. It functions as a security policy manager, observability agent, and enforcement engine that hooks into kernel functions and tracepoints to detect privilege escalation, container escapes, and unauthorized system activity. The project distinguishes itself through its ability to perform real-time, in-kernel enforcement, allowing it to synchronously terminate malicious processes or modify function return values before a system call completes. It provides deep Kubernetes integration

Sysdig is a Linux system observability tool and kernel event analyzer designed for capturing and analyzing kernel-level system calls and operating system events. It functions as a system call tracer and container security monitor, providing deep visibility into the activity of machines, virtual machines, and containers. The project specializes in non-invasive container inspection, allowing for the monitoring of container activity and resource usage without modifying the container environment or adding instrumentation. It enables the recording of detailed system traces into binary files for re

This project is a comprehensive educational resource and curriculum focused on site reliability engineering, distributed systems, and infrastructure operations. It provides technical guides, a systems engineering course, and instructional manuals designed to teach the principles of managing large-scale computing environments. The curriculum covers high-level architectural design for scalability and resilience, including fault-tolerant infrastructure, high-availability patterns, and microservices decomposition. It emphasizes the practical application of site reliability engineering through the

PsySH is an interactive read-eval-print loop and shell environment for PHP. It functions as a runtime debugger and application inspector, allowing for the execution of PHP code in real-time to experiment with snippets and inspect live application state. The project is distinguished by its ability to be embedded directly into running PHP applications for live troubleshooting. It provides specialized tools for state manipulation, including the ability to bypass visibility restrictions to inspect private or protected object members and the capacity to reload code without restarting the session.

Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o

Subfinder is a security reconnaissance framework designed for subdomain enumeration and attack surface management. It functions as a discovery engine that identifies and maps internet-exposed infrastructure, cloud-hosted assets, and network ranges to maintain a comprehensive inventory of an organization's digital footprint. The project distinguishes itself through a modular, template-driven scanning engine that executes security checks against discovered assets. It leverages cloud-native asset discovery to query provider APIs and infrastructure metadata, while supporting distributed agent orc

Excelize is a library for reading and writing spreadsheet files in the Office Open XML format. It provides a comprehensive suite of tools for programmatically creating, modifying, and analyzing workbooks, worksheets, and cell data, ensuring compatibility across various office software suites through structured XML serialization. The library distinguishes itself with a built-in formula calculation engine that evaluates complex mathematical and logical expressions directly against workbook data. It also features a memory-mapped streaming architecture, which allows for the efficient processing o

This project is a security hardening guide and privacy configuration manual for macOS. It provides a comprehensive set of instructions for configuring system settings to improve privacy, reduce the attack surface, and implement a malware defense framework. The guide covers technical methods for validating software notarization, verifying application sandboxing, and auditing system activity. It distinguishes itself by providing detailed workflows for restricting high-risk features and applying advanced security configurations to protect the operating system. The documentation covers several k

pyinstrument is a statistical sampling profiler for Python that records the call stack at regular intervals to identify performance bottlenecks with low overhead. It tracks wall-clock time, including I/O and external service calls, and provides specialized profiling for asynchronous programs by attributing time spent awaiting tasks to the calling function. The project converts captured execution data into interactive HTML reports, JSON, and flamecharts. It includes a call stack visualizer to simplify the analysis of execution paths and supports the profiling of individual cells within interac

This project is a structured course and instructional guide focused on x64 Windows reverse engineering. It provides a curriculum for analyzing and decompiling Windows binaries through the study of assembly language and operating system internals. The material covers Windows binary analysis and malware analysis, with a specific focus on interpreting x64 machine code to recover original program logic. It guides the user through the process of tracing program behavior and logging function calls to understand how binaries operate. The technical scope includes assembly-level decompilation, debugg

vjtools is a comprehensive Java development toolset and runtime monitor designed for optimizing application performance and ensuring codebase consistency. It provides a suite of JVM diagnostics tools, a performance profiler, and a static analysis system for enforcing coding standards. The project distinguishes itself through specialized runtime observability, including the ability to attach to processes via process ID and inject dynamic probes to monitor method calls without restarting the system. It features container-aware resource detection that reads control group files to report actual C

Booster is an Android app build optimizer and bytecode manipulator designed to reduce binary size, fix system-level crashes, and improve application performance. It functions as an extensible build process plugin that modifies compiled class files and build artifacts to inject stability fixes and optimizations without altering the original source code. The project differentiates itself through low-level bytecode manipulation to patch OS-level bugs and manage thread pools during the compilation phase. It also provides a performance profiling toolkit to identify main-thread blocking operations

Arthas is a Java diagnostic tool and runtime debugger designed for real-time troubleshooting of applications. It functions as a remote diagnostics agent that allows users to inspect the runtime state of a Java process, including its heap objects and classloader hierarchies, without requiring a process restart. The project distinguishes itself through advanced bytecode manipulation capabilities, enabling live class hotswapping and the modification of bytecode in running processes. It supports in-memory source compilation and runtime bytecode decompilation to verify and update logic instantly w

DeepFlow is an eBPF observability platform that provides a suite for continuous profiling, distributed tracing, service dependency mapping, and unified telemetry storage. It functions as a monitoring system that collects metrics, traces, and profiles without requiring manual application instrumentation or modifications to source code. The platform distinguishes itself through the use of protocol-aware packet parsing to reconstruct request chains and automated service dependency mapping to visualize interactions between applications and infrastructure. It utilizes a telemetry data store design

Samply is a cross-platform CPU sampling profiler and performance analysis utility. It consists of a command-line tool for recording process stack traces at regular intervals and a visual interface for analyzing the resulting execution data. The system includes a debug symbol resolver that maps raw memory addresses to human-readable function names using local or remote symbol information. It transforms recorded execution data into flame graphs and timelines to pinpoint function-level hotspots. The tool provides capabilities for CPU execution recording, stack unwinding, and symbol resolution a

Aya is a Rust-native framework for writing, compiling, and loading eBPF programs into the Linux kernel. It provides a complete development environment that eliminates the need for a C toolchain or libbpf, allowing developers to work entirely within the Rust ecosystem. The framework manages the full lifecycle of eBPF programs, including async runtime integration, CO-RE BTF resolution for kernel version portability, ELF-based program loading, and safe kernel memory access. The framework distinguishes itself through its pure Rust compilation pipeline, which compiles Rust source code directly int

Hotspot is a graphical user interface for analyzing and visualizing performance data captured by the Linux perf tool. It functions as a performance profiling visualizer and assembly-level profiler that maps performance costs to specific instructions synchronized with original source code. The project distinguishes itself through a remote symbol resolver that maps performance data from embedded targets to local host debug symbols and sysroots. It also includes a specialized off-CPU analysis tool designed to identify thread wait times and I/O blocks using kernel scheduler tracepoints. The tool

SkyWalking is an application performance monitoring system and observability platform designed to collect and analyze metrics, traces, and logs from distributed microservices. It functions as a distributed tracing platform and a telemetry data pipeline that ingests and aggregates observability data from various language agents. The project features an AI-powered anomaly detector that uses machine learning to calculate metric baselines and identify irregular URI patterns. It includes an eBPF performance profiler for diagnosing CPU and network bottlenecks at the kernel level and generates inter

Perfetto is a platform for system-level performance tracing and analysis on Linux and Android. It combines a high-throughput trace recorder, a SQL-based query engine, and a browser-based visualizer into a single toolchain. The platform covers CPU scheduling and call-stack profiling, native and Java heap memory allocation tracking, GPU and graphics events, and system-wide counters such as CPU frequency and power consumption. The architecture decouples trace recording from offline analysis, using a compact protobuf format for event encoding and columnar storage for efficient SQL queries. The we

This project is a curated resource directory and tooling list for the extended Berkeley Packet Filter technology. It serves as a reference guide to software projects, libraries, and frameworks built on the eBPF kernel subsystem. The directory covers a range of domains including Linux kernel observability, system security monitoring, and cloud native networking. It also provides an eBPF learning path with tutorials and guides for those implementing custom kernel instrumentation. The collection is maintained as a markdown-based directory using a manual curation workflow to organize external to