bpftrace

bpftrace is a free, self-hosted tracing language and tool for Linux systems that use eBPF. It supports tracing in kernel and user space, with perf events, USDT, uprobes, and tracepoints among its sources. Programs can be supplied as files, entered inline with -e, or passed through standard input. The language takes inspiration from awk, C, DTrace, and SystemTap, and its standard library includes builtins, functions, macros, and map value functions. LLVM compiles scripts to eBPF bytecode, while libbpf helps interact with Linux's BPF subsystem. Scripts can import bpftrace files, C headers, and BPF C source; imports from world-writable directories are refused, and helpers marked unsafe require the --unsafe flag. The default maximum is 1,024 probes. Raising it can increase memory use and startup time, produce high overhead, or contribute to system freezes or crashes. Some features require kernel headers, and vmlinux BTF support requires Linux 4.18 or later with CONFIG_DEBUG_INFO_BTF enabled. The project lists multiple Linux package-manager installation options and community support channels.

bpftrace offers Linux tracing through a high-level scripting language and a broad set of probe sources. Check kernel requirements and the default probe limit before using it on a system where overhead matters.

bpftrace suits Linux users who need kernel or user-space tracing for debugging or production tracing. It requires a compatible Linux kernel and BPF support.

bpftrace is a Linux tracing tool that lets users write high-level scripts to inspect kernel and application activity. It is best suited to engineers and operators comfortable working with Linux systems. Its broad probe coverage makes it a strong choice for targeted investigations, provided the kernel supports the features you need and you account for the default probe limit.

Overview

bpftrace uses eBPF to trace both kernel and user-space activity. Its language draws on awk, C, DTrace, and SystemTap, giving experienced systems users a concise way to express tracing work without writing each program as low-level BPF code. Scripts can be run from a file, entered inline with -e, or piped through standard input, so the same tool can serve one-off debugging and repeatable workflows.

LLVM compiles scripts to eBPF bytecode; libbpf and bcc connect them to Linux BPF. The tool is free and self-hosted, with no paid tier or trial. That makes it accessible to teams able to manage their own Linux environment, while leaving compatibility and operational setup in their hands.

Key features

Kernel and user-space probes

bpftrace supports kprobes, uprobes, tracepoints, perf events, and USDT, covering static and dynamic tracing across kernel and application boundaries. That range is useful when an issue could originate in either layer, and when a focused trace is preferable to deploying a broader observability platform. Its scope is Linux-specific, so it is not a fit for teams seeking one tracing workflow across operating systems.

Scripts and imports

The standard library provides builtins, functions, macros, and map value functions. Scripts can also import bpftrace files, C headers, BPF C source, and supported files from a directory. Helpers marked unsafe require the --unsafe flag, and imports from world-writable directories are refused. These controls make script reuse practical while adding safeguards around potentially risky operations and file sources.

Installation and editor support

Package-manager commands are provided for distributions including Ubuntu, Fedora, Alpine, Arch, Gentoo, Nix, and openSUSE. A community language server adds autocomplete, diagnostics, and go-to-definition in editors that support LSP. The web playground can help with exploration, but it does not support every bpftrace feature, so it cannot stand in for a compatible Linux system.

Pricing

The bpftrace plan costs free and provides the open-source Linux tracing tool. There is no free trial because the software is free to use. The plan has no stated seat or usage quota; its practical limits come from Linux and BPF compatibility, available system resources, and the tool's operating constraints.

Platforms

bpftrace runs on Linux and is self-hosted. Supported architectures include x86_64, arm64, s390x, arm32, loongarch64, mips64, ppc64, and riscv64. Some features require kernel headers; BTF support for vmlinux requires Linux 4.18 or later with CONFIG_DEBUG_INFO_BTF enabled. Readers should check their kernel configuration before relying on those capabilities.

Who it's for

bpftrace suits Linux engineers and operators who need production tracing or debugging across kernel and user space, and who are prepared to write and manage scripts. Its focused tracing model is a good match for investigating low-level system behavior. Teams seeking a cross-platform interface, a hosted service, or a complete observability suite should look elsewhere.

Pros and cons

• Pros: Broad kernel and user-space probe support lets one tool investigate issues across system boundaries.
• Pros: File, inline, and standard-input script delivery supports both reusable programs and quick investigations.
• Pros: Free, self-hosted availability and distribution package instructions make it accessible across a range of Linux environments.
• Cons: The default maximum of 1,024 probes can constrain workloads that need more; raising it increases memory use and startup time and may cause high overhead, freezes, or crashes.
• Cons: Kernel headers and BTF configuration are required for some features, complicating use on systems without the needed kernel support.
• Cons: Unstable features may change or be removed, so scripts that depend on them can require maintenance.

Alternatives

Choose BCC if you want another free, self-hosted Linux tracing tool and can work with its Linux kernel 4.1 or newer requirement. DeepFlow is worth considering for its free community edition, free trial, and support across Linux, Android, Windows, web, and self-hosted environments. For a tool centered on Kubernetes, consider Caretta, which is also free and self-hosted on Linux.

Grafana k6 offers a free plan capped at 500 virtual user hours per month, with a Pro plan at $19 a month; it is a different option for readers whose needs fit its plan structure. groundcover has a free plan with 12-hour data retention and a Pro plan starting at $30; consider it if those service terms suit your requirements. Kubeshark offers a free community plan limited to 3 nodes or 60 pods and requiring internet connectivity. Parca is another free option with components under the Apache 2 License. Coroot offers a self-hosted Community Edition and a Standard plan priced at $1 a month per monitored CPU core.

Browse eBPF Observability Tools to compare more options in the category.

Verdict

bpftrace is an excellent fit for Linux practitioners who want a free, scriptable way to trace activity across the kernel and user space. Its probe breadth and flexible script delivery are the main reasons to choose it. Look elsewhere if your systems lack the required kernel support, if the probe ceiling and its overhead trade-offs are unacceptable, or if you need a cross-platform or hosted observability product.