Bcc

BCC is an eBPF development toolkit and tracing framework used for monitoring and analyzing the Linux kernel. It functions as a performance analysis tool and debugging utility to capture system events, measure kernel latency, and provide network observability.

The project distinguishes itself by providing a build system that integrates with LLVM to compile C-like code into BPF bytecode at runtime. It utilizes BPF Type Format data for relocations to maintain cross-kernel compatibility and extracts kernel headers to ensure the generated programs match the specific kernel version.

The toolkit covers a broad range of instrumentation capabilities, including deep kernel monitoring of CPU scheduling, memory management, and process lifecycles. It provides specialized tools for network traffic analysis, block device and filesystem I/O performance tracing, and user-space application inspection via probes. Statistical data is visualized through linear and logarithmic histograms.

Features

Kernel Observability Programs - Develops and executes BPF programs for advanced system observability and kernel analysis.
Kernel Tracing Frameworks - Functions as a comprehensive framework for instrumenting kernel functions and tracepoints to capture system events.
CPU Profilers - Samples stack traces at timed intervals to identify active code paths and performance bottlenecks.
Off-CPU Latency Analyzers - Measures the duration threads spend in a blocked state and captures the associated stack traces.
Network Traffic Analyzers - Provides utilities for capturing and debugging network protocols and TCP connection streams via eBPF.
Instrumentation & Hooking - Provides dynamic instrumentation and hooking capabilities via kprobes to capture kernel execution state.
BPF Compilation Toolchains - Provides a build system integrating LLVM and kernel headers to compile monitoring tools into BPF bytecode.
BPF Map Management - Stores shared state between kernel and user space using hash tables, arrays, and histograms.
BPF Map Structures - Implements kernel-level data storage using BPF maps including hashes, arrays, and histograms.
eBPF Tooling - Serves as a comprehensive toolkit for compiling, loading, and executing eBPF programs for kernel monitoring.
Kernel Debuggers - Provides utilities for detecting memory leaks, lock contention, and deadlocks within the Linux kernel.
Kernel Lock Analyzers - Detects and analyzes lock contention and deadlocks within the kernel to resolve system hangs.
Syscall Argument Inspection - Intercepts kernel system calls to capture detailed argument data and return values in real time.
BPF Bytecode Compilers - Uses LLVM to compile C-like code into BPF bytecode at runtime for the specific running kernel.
Function Execution Timing - Measures the time spent in kernel or user-space functions to locate performance regressions.
System Call Tracing - Intercepts system calls to capture arguments and execution results in real time.
Kernel Event Tracers - Monitors specific kernel tracepoints to capture and report real-time system events.
Function Latency Tracing - Identifies function calls that exceed a specified latency threshold and captures their return values and arguments.
Dynamic Kernel Probes - Lists available kernel tracepoints and probes along with their associated data formats and arguments.
Probe Discovery Utilities - Provides utilities to locate and identify available kernel tracepoints and probes, including argument formats.
Execution Tracing - Monitors exec system calls to identify new processes and capture their command arguments.
eBPF Profilers - Provides specialized eBPF-based profiling for measuring kernel latency, CPU scheduling, and I/O performance.
System Activity Monitoring - Monitors kernel syscalls system-wide to log activities such as file open requests.
Run Queue Analysis - Provides tools to sample kernel run queues and generate occupancy histograms to identify CPU scheduling bottlenecks.
Distribution Histograms - Generates distribution histograms to analyze kernel event data, such as the distribution of I/O sizes.
Query Performance Monitors - Produces histograms of execution times for database queries to identify performance bottlenecks.
HTTP Latency Tracing - Monitors the time spent processing individual HTTP requests to identify performance bottlenecks.
Thread Wakeup Analyzers - Records stack traces of threads that wake up blocked processes to diagnose lock contention.
Connection Monitors - Provides process-level inspection of successful TCP socket connection acceptances.
I/O Latency Tracers - Implements diagnostic tools that capture stack traces and latency for block device I/O operations.
Network Condition Monitors - Monitors real-time network status and connection quality, including TCP/UDP round-trip times and packet drops.
Network Traffic Controllers - Provides software solutions for managing packet flow and enforcing connectivity rules like rate limiting and steering.
Network Traffic Inspectors - Examines TCP session lifespans, connection latencies, and throughput per host via kernel tracing.
Packet Capture Engines - Implements a high-performance engine for intercepting and copying raw network traffic from interfaces.
Packet Redirection - Reroutes incoming packets to different interfaces, CPUs, or sockets using eBPF maps.
TCP Connection Tracing - Monitors kernel functions to identify active TCP connections, capturing process IDs, addresses, and ports.
TCP Packet Drop Analysis - Identifies TCP packets dropped by the kernel and outputs the specific drop reason.
Connection Latency Analysis - Traces kernel functions for active TCP connections to calculate response times for SYN packets.
TCP Session Management - Captures and summarizes TCP session data, including duration, bytes transferred, and process IDs.
Retransmission Tracing - Monitors and counts TCP retransmits and tail loss probes to identify packet loss.
Traffic Filters - Implements tools for inspecting and controlling network packets based on defined rules and criteria.
Relocation Mechanisms - Implements runtime relocation logic using BPF Type Format data to ensure cross-kernel compatibility.
BPF Program Introspection - BCC analyzes active programs and maps and generates skeletons to facilitate loading and interaction.
Operation Tracing - Monitors filesystem calls to identify slow synchronous reads, writes, and cache hit ratios.
Memory Allocation Tracers - Tracks the rate of allocations and total bytes used by kernel memory caches to monitor memory usage.
Allocation Frequency Analyzers - Summarizes new object allocation events by type and size to identify inefficient memory usage patterns.
Kernel Deadlock Detection - Traces mutex lock and unlock calls to build wait graphs and detect lock order inversions.
Kernel Header Parsers - Parses kernel source headers to generate necessary type definitions for compiling BPF programs.
Kernel Symbol Resolution - Converts kernel or process memory addresses to function names and vice versa.
Kernel-to-User Event Export - Pushes custom event data from the kernel to user space using high-performance ring buffers.
Kernel Type Extractors - Extracts kernel types and internal definitions into header files to maintain cross-version compatibility.
Process Lifecycle Management - Tracks process creation, termination, and signal delivery to identify unstable applications.
Scheduler Analysis Tools - Samples the length of CPU run queues to identify idle processors while threads wait for execution.
User-Space Memory Inspection - Copies data or strings from user address space to the stack to examine application data.
Capability Request Tracing - Monitors calls to security functions to identify which capabilities processes are requesting from the kernel.
Execution Flow Analyzers - Traces method entry and exit events to visualize the execution paths of a program.
Lock Statistics Monitors - Traces lock events to calculate statistics on acquisition counts, hold times, and call stacks.
TCP Listeners - Monitors mechanisms for accepting and handling incoming TCP network connections, logging PIDs and IP addresses.
Out-of-Memory Analysis - Monitors the out-of-memory killer to identify terminated processes and correlate them with system load.
Synchronization Tracing - Monitors calls to kernel synchronization routines and records timestamps and process names to analyze lock behavior.
Event Latency Measurements - Tracks the time elapsed between a kernel function entry and its return to calculate execution duration.
Exit Code Trackers - Monitors all process exits and fatal signals to capture PIDs and exit codes.
Filesystem Latency Monitoring - Measures the performance and latency distribution of VFS and specific filesystem operations.
Language-Specific Monitoring - Tracks runtime events such as garbage collections and method calls for processes running high-level languages.
Database Query Latency - Provides latency histograms to analyze the execution duration of database queries using eBPF probes.
Kernel Ring Buffer Streams - Uses high-performance shared memory ring buffers to stream event data from kernel to user space.
User-Defined Probes - Attaches to user-defined probes embedded in applications to provide custom event tracking.
Slow Query Analyzers - Identifies and logs database queries that exceed specified time thresholds using eBPF probes.
Cache Performance Metrics - Tracks system-wide cache reference and miss events to calculate hit rates summarized by process.
Network Traffic Analyzers - Monitors and visualizes real-time network data, specifically tracking packet counts and byte distributions across interface queues.
Packet Inspection - Performs deep analysis of kernel-dropped TCP packets and provides associated kernel stack traces.
Disk I/O Performance Analysis - Tracks block device performance and provides distributions of I/O sizes to analyze disk behavior.
Garbage Collection Monitors - Monitors garbage collection events in high-level languages to record descriptions and pause durations.
Scheduling Delay Analysis - Measures the time tasks spend waiting in a run queue before executing on a CPU.
Runtime Environment Inspection - Collects runtime events including garbage collection, object allocation, and thread creation for high-level languages.
Socket Bind Tracing - Monitors bind system calls to report which processes are attempting to bind to specific ports.
Socket Monitoring Tools - Uses low-level socket monitoring to capture process IDs and ports during socket binding operations.
System Latency Monitors - Measures softirq execution duration and wakeup delays to optimize real-time kernel performance.
Execution Stack Samplers - Captures the application-level stack trace of a process when it triggers a specific kernel event.
Stack Trace Aggregators - Aggregates associated call stacks for specific events to identify common execution paths.
User-Space Application Inspection - Traces method calls, garbage collection events, and object allocations in high-level languages using probes.
User-Space Call Monitoring - Monitors the return values of specific library functions to capture real-time activity.
User-Space Function Tracing - Instruments user-level library or binary functions to monitor application behavior.
Memory Leak Detection - Traces kernel memory allocations and deallocations to identify call stacks that leak memory.
Function Call Tracking - Traces functions or probes matching patterns to provide accurate call counts for code usage analysis.
Method Call Profiling - Tracks the frequency and duration of method calls in high-level languages and system calls.
Statistical Distribution Visualizers - Visualizes BPF map data using ASCII-based linear and logarithmic histograms for statistical analysis.
Infrastructure and Monitoring - BPF-based Linux IO analysis and monitoring.
Debugging And Tracing - Analyzes Linux IO and networking via BPF.
Developer Toolkits - Toolkit for building efficient kernel tracing and manipulation programs.
Development Frameworks - Framework for tracing, monitoring, and inspecting BPF programs.
System Profiling Tools - BPF-based Linux IO analysis and monitoring.

Star history

iovisorbcc

Name: iovisor/bcc
Author: iovisor

View on GitHub

22,459 stars4,053 forksCApache-2.011 views

Bcc

Features

Kernel Observability Programs - Develops and executes BPF programs for advanced system observability and kernel analysis.
Kernel Tracing Frameworks - Functions as a comprehensive framework for instrumenting kernel functions and tracepoints to capture system events.
CPU Profilers - Samples stack traces at timed intervals to identify active code paths and performance bottlenecks.
Off-CPU Latency Analyzers - Measures the duration threads spend in a blocked state and captures the associated stack traces.
Network Traffic Analyzers - Provides utilities for capturing and debugging network protocols and TCP connection streams via eBPF.
Instrumentation & Hooking - Provides dynamic instrumentation and hooking capabilities via kprobes to capture kernel execution state.
BPF Compilation Toolchains - Provides a build system integrating LLVM and kernel headers to compile monitoring tools into BPF bytecode.
BPF Map Management - Stores shared state between kernel and user space using hash tables, arrays, and histograms.
BPF Map Structures - Implements kernel-level data storage using BPF maps including hashes, arrays, and histograms.
eBPF Tooling - Serves as a comprehensive toolkit for compiling, loading, and executing eBPF programs for kernel monitoring.
Kernel Debuggers - Provides utilities for detecting memory leaks, lock contention, and deadlocks within the Linux kernel.
Kernel Lock Analyzers - Detects and analyzes lock contention and deadlocks within the kernel to resolve system hangs.
Syscall Argument Inspection - Intercepts kernel system calls to capture detailed argument data and return values in real time.
BPF Bytecode Compilers - Uses LLVM to compile C-like code into BPF bytecode at runtime for the specific running kernel.
Function Execution Timing - Measures the time spent in kernel or user-space functions to locate performance regressions.
System Call Tracing - Intercepts system calls to capture arguments and execution results in real time.
Kernel Event Tracers - Monitors specific kernel tracepoints to capture and report real-time system events.
Function Latency Tracing - Identifies function calls that exceed a specified latency threshold and captures their return values and arguments.
Dynamic Kernel Probes - Lists available kernel tracepoints and probes along with their associated data formats and arguments.
Probe Discovery Utilities - Provides utilities to locate and identify available kernel tracepoints and probes, including argument formats.
Execution Tracing - Monitors exec system calls to identify new processes and capture their command arguments.
eBPF Profilers - Provides specialized eBPF-based profiling for measuring kernel latency, CPU scheduling, and I/O performance.
System Activity Monitoring - Monitors kernel syscalls system-wide to log activities such as file open requests.
Run Queue Analysis - Provides tools to sample kernel run queues and generate occupancy histograms to identify CPU scheduling bottlenecks.
Distribution Histograms - Generates distribution histograms to analyze kernel event data, such as the distribution of I/O sizes.
Query Performance Monitors - Produces histograms of execution times for database queries to identify performance bottlenecks.
HTTP Latency Tracing - Monitors the time spent processing individual HTTP requests to identify performance bottlenecks.
Thread Wakeup Analyzers - Records stack traces of threads that wake up blocked processes to diagnose lock contention.
Connection Monitors - Provides process-level inspection of successful TCP socket connection acceptances.
I/O Latency Tracers - Implements diagnostic tools that capture stack traces and latency for block device I/O operations.
Network Condition Monitors - Monitors real-time network status and connection quality, including TCP/UDP round-trip times and packet drops.
Network Traffic Controllers - Provides software solutions for managing packet flow and enforcing connectivity rules like rate limiting and steering.
Network Traffic Inspectors - Examines TCP session lifespans, connection latencies, and throughput per host via kernel tracing.
Packet Capture Engines - Implements a high-performance engine for intercepting and copying raw network traffic from interfaces.
Packet Redirection - Reroutes incoming packets to different interfaces, CPUs, or sockets using eBPF maps.
TCP Connection Tracing - Monitors kernel functions to identify active TCP connections, capturing process IDs, addresses, and ports.
TCP Packet Drop Analysis - Identifies TCP packets dropped by the kernel and outputs the specific drop reason.
Connection Latency Analysis - Traces kernel functions for active TCP connections to calculate response times for SYN packets.
TCP Session Management - Captures and summarizes TCP session data, including duration, bytes transferred, and process IDs.
Retransmission Tracing - Monitors and counts TCP retransmits and tail loss probes to identify packet loss.
Traffic Filters - Implements tools for inspecting and controlling network packets based on defined rules and criteria.
Relocation Mechanisms - Implements runtime relocation logic using BPF Type Format data to ensure cross-kernel compatibility.
BPF Program Introspection - BCC analyzes active programs and maps and generates skeletons to facilitate loading and interaction.
Operation Tracing - Monitors filesystem calls to identify slow synchronous reads, writes, and cache hit ratios.
Memory Allocation Tracers - Tracks the rate of allocations and total bytes used by kernel memory caches to monitor memory usage.
Allocation Frequency Analyzers - Summarizes new object allocation events by type and size to identify inefficient memory usage patterns.
Kernel Deadlock Detection - Traces mutex lock and unlock calls to build wait graphs and detect lock order inversions.
Kernel Header Parsers - Parses kernel source headers to generate necessary type definitions for compiling BPF programs.
Kernel Symbol Resolution - Converts kernel or process memory addresses to function names and vice versa.
Kernel-to-User Event Export - Pushes custom event data from the kernel to user space using high-performance ring buffers.
Kernel Type Extractors - Extracts kernel types and internal definitions into header files to maintain cross-version compatibility.
Process Lifecycle Management - Tracks process creation, termination, and signal delivery to identify unstable applications.
Scheduler Analysis Tools - Samples the length of CPU run queues to identify idle processors while threads wait for execution.
User-Space Memory Inspection - Copies data or strings from user address space to the stack to examine application data.
Capability Request Tracing - Monitors calls to security functions to identify which capabilities processes are requesting from the kernel.
Execution Flow Analyzers - Traces method entry and exit events to visualize the execution paths of a program.
Lock Statistics Monitors - Traces lock events to calculate statistics on acquisition counts, hold times, and call stacks.
TCP Listeners - Monitors mechanisms for accepting and handling incoming TCP network connections, logging PIDs and IP addresses.
Out-of-Memory Analysis - Monitors the out-of-memory killer to identify terminated processes and correlate them with system load.
Synchronization Tracing - Monitors calls to kernel synchronization routines and records timestamps and process names to analyze lock behavior.
Event Latency Measurements - Tracks the time elapsed between a kernel function entry and its return to calculate execution duration.
Exit Code Trackers - Monitors all process exits and fatal signals to capture PIDs and exit codes.
Filesystem Latency Monitoring - Measures the performance and latency distribution of VFS and specific filesystem operations.
Language-Specific Monitoring - Tracks runtime events such as garbage collections and method calls for processes running high-level languages.
Database Query Latency - Provides latency histograms to analyze the execution duration of database queries using eBPF probes.
Kernel Ring Buffer Streams - Uses high-performance shared memory ring buffers to stream event data from kernel to user space.
User-Defined Probes - Attaches to user-defined probes embedded in applications to provide custom event tracking.
Slow Query Analyzers - Identifies and logs database queries that exceed specified time thresholds using eBPF probes.
Cache Performance Metrics - Tracks system-wide cache reference and miss events to calculate hit rates summarized by process.
Network Traffic Analyzers - Monitors and visualizes real-time network data, specifically tracking packet counts and byte distributions across interface queues.
Packet Inspection - Performs deep analysis of kernel-dropped TCP packets and provides associated kernel stack traces.
Disk I/O Performance Analysis - Tracks block device performance and provides distributions of I/O sizes to analyze disk behavior.
Garbage Collection Monitors - Monitors garbage collection events in high-level languages to record descriptions and pause durations.
Scheduling Delay Analysis - Measures the time tasks spend waiting in a run queue before executing on a CPU.
Runtime Environment Inspection - Collects runtime events including garbage collection, object allocation, and thread creation for high-level languages.
Socket Bind Tracing - Monitors bind system calls to report which processes are attempting to bind to specific ports.
Socket Monitoring Tools - Uses low-level socket monitoring to capture process IDs and ports during socket binding operations.
System Latency Monitors - Measures softirq execution duration and wakeup delays to optimize real-time kernel performance.
Execution Stack Samplers - Captures the application-level stack trace of a process when it triggers a specific kernel event.
Stack Trace Aggregators - Aggregates associated call stacks for specific events to identify common execution paths.
User-Space Application Inspection - Traces method calls, garbage collection events, and object allocations in high-level languages using probes.
User-Space Call Monitoring - Monitors the return values of specific library functions to capture real-time activity.
User-Space Function Tracing - Instruments user-level library or binary functions to monitor application behavior.
Memory Leak Detection - Traces kernel memory allocations and deallocations to identify call stacks that leak memory.
Function Call Tracking - Traces functions or probes matching patterns to provide accurate call counts for code usage analysis.
Method Call Profiling - Tracks the frequency and duration of method calls in high-level languages and system calls.
Statistical Distribution Visualizers - Visualizes BPF map data using ASCII-based linear and logarithmic histograms for statistical analysis.
Infrastructure and Monitoring - BPF-based Linux IO analysis and monitoring.
Debugging And Tracing - Analyzes Linux IO and networking via BPF.
Developer Toolkits - Toolkit for building efficient kernel tracing and manipulation programs.
Development Frameworks - Framework for tracing, monitoring, and inspecting BPF programs.
System Profiling Tools - BPF-based Linux IO analysis and monitoring.

Open-source alternatives to Bcc

Similar open-source projects, ranked by how many features they share with Bcc.

brendangregg/flamegraph
brendangregg/FlameGraph
19,307View on GitHub
FlameGraph is a performance profiling and visualization toolkit designed to identify bottlenecks in software execution. It functions as a processing engine that transforms raw stack trace samples into interactive, hierarchical diagrams. By representing aggregated execution frequency as nested rectangles, the tool allows developers to visualize hot code paths and analyze system behavior across both kernel and user-space environments. The project distinguishes itself through its ability to perform differential profile analysis, which highlights performance regressions or improvements by compari
Perl
View on GitHub19,307
bpftrace/bpftrace
bpftrace/bpftrace
9,950View on GitHub
bpftrace is a high-level eBPF tracing tool and kernel instrumentation framework for Linux. It provides a tracing language to instrument kernel and user-space events without recompiling the system, functioning as a dynamic system profiler and event aggregator. The project enables dynamic system tracing and Linux kernel observability by capturing tracepoints and dynamic probes in real time. It allows for kernel data inspection and runtime process debugging by accessing internal data structures and filtering specific process events. Its capability surface covers system performance analysis, inc
C++bccbpfebpf
View on GitHub9,950
brendangregg/perf-tools
brendangregg/perf-tools
10,434View on GitHub
This project is a specialized toolset for profiling kernel latency, analyzing tracepoint frequency, and monitoring system-wide performance data. It functions as a kernel performance profiler, tracepoint analyzer, and a collection of utilities for the Linux ftrace and perf_events subsystems. The toolkit provides high-level abstractions via shell-scripted wrappers to manage complex kernel tracing interfaces. It distinguishes itself through the use of bucket-based event histograms to visualize the distribution of kernel events and the ability to identify functions exceeding specific latency thre
Shell
View on GitHub10,434
cilium/tetragon
cilium/tetragon
4,753View on GitHub
Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments. It functions as a security policy manager, observability agent, and enforcement engine that hooks into kernel functions and tracepoints to detect privilege escalation, container escapes, and unauthorized system activity. The project distinguishes itself through its ability to perform real-time, in-kernel enforcement, allowing it to synchronously terminate malicious processes or modify function return values before a system call completes. It provides deep Kubernetes integration
C
View on GitHub4,753

See all 30 alternatives to Bcc

Frequently asked questions

What does iovisor/bcc do?

What are the main features of iovisor/bcc?

The main features of iovisor/bcc are: Kernel Observability Programs, Kernel Tracing Frameworks, CPU Profilers, Off-CPU Latency Analyzers, Network Traffic Analyzers, Instrumentation & Hooking, BPF Compilation Toolchains, BPF Map Management.

What are some open-source alternatives to iovisor/bcc?

Open-source alternatives to iovisor/bcc include: brendangregg/flamegraph — FlameGraph is a performance profiling and visualization toolkit designed to identify bottlenecks in software… bpftrace/bpftrace — bpftrace is a high-level eBPF tracing tool and kernel instrumentation framework for Linux. It provides a tracing… brendangregg/perf-tools — This project is a specialized toolset for profiling kernel latency, analyzing tracepoint frequency, and monitoring… cilium/tetragon — Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments.… eunomia-bpf/bpf-developer-tutorial — This project is an educational resource providing a comprehensive development tutorial for writing and loading eBPF… falcosecurity/falco — Falco is an eBPF runtime security monitor and cloud native detection engine that identifies abnormal behavior and…

Bcc

Features

Star history

Bcc

Features

Open-source alternatives to Bcc

brendangregg/FlameGraph

bpftrace/bpftrace

brendangregg/perf-tools

cilium/tetragon

Frequently asked questions

Star history

Frequently asked questions

Open-source alternatives to Bcc

brendangregg/FlameGraph

bpftrace/bpftrace

brendangregg/perf-tools

cilium/tetragon