Skip to content
SPECIFICTION
Get listed

bpftrace

bpftrace.org

Free plan LinuxSelf-hosted
Visit bpftrace.org
Spec score 8.6 #4 of 29 in eBPF Observability Tools

What it is

bpftrace is a free, high-level tracing language and general-purpose Linux tracing tool built on eBPF. It supports kernel and user-space dynamic tracing, perf events, USDT, uprobes, and tracepoints. Its language draws from awk, C, DTrace, and SystemTap. Programs can come from files, inline -e input, or standard input, and the standard library supplies builtins, functions, macros, and map-value functions. LLVM compiles scripts to eBPF bytecode; libbpf interacts with Linux’s BPF subsystem, with bcc also used in the implementation. Scripts can import bpftrace files, C headers, BPF C source, and supported directory files. Unsafe helpers require --unsafe, and imports from world-writable directories are refused. The default probe maximum is 1,024; increasing it can raise memory use, startup time, overhead, or risk freezes and crashes. Supported architectures include x86_64, arm64, s390x, arm32, loongarch64, mips64, ppc64, and riscv64. Some features need kernel headers; vmlinux BTF needs Linux 4.18 or later with CONFIG_DEBUG_INFO_BTF enabled.

Spec sheet

Purpose
bpftrace is a high-level tracing language for Linux for writing observability-based eBPF programs.Read 4 Oct 2026 · bpftrace.org
Intended users
The project says its contributors, users, and organizations rely on it for production tracing and debugging.Read 3 Oct 2026 · github.com
Security
As a security measure, bpftrace refuses to import files from world-writable directories.Read 4 Oct 2026 · bpftrace.org
Support
The project README lists GitHub Discussions, the issue tracker, monthly office hours, and Discord as ways to get help or participate.Read 4 Oct 2026 · github.com
Architectures
The documentation lists x86_64, arm64, s390x, arm32, loongarch64, mips64, ppc64, and riscv64 as supported architectures.Read 4 Oct 2026 · bpftrace.org
Compiler and libraries
bpftrace uses LLVM as a compiler backend and libbpf to interact with the Linux BPF subsystem.Read 3 Oct 2026 · github.com
Implementation
bpftrace uses LLVM to compile scripts to eBPF bytecode and uses libbpf and bcc to interact with Linux BPF.Read 4 Oct 2026 · bpftrace.org
Import security
bpftrace refuses to import files from world-writable directories.Read 3 Oct 2026 · bpftrace.org
Install options
The project README lists package-manager installation commands for distributions including Ubuntu, Fedora, Alpine, Arch, Gentoo, Nix, and openSUSE.Read 4 Oct 2026 · github.com
Installation
The project README lists installation commands for several Linux distribution package managers, including apt, dnf, apk, pacman, emerge, and zypper.Read 3 Oct 2026 · github.com
Integration
A community language server offers autocompletion, error diagnostics, and go-to-definition in editors that support LSP.Read 4 Oct 2026 · bpftrace.org
Language
The bpftrace language is inspired by awk, C, DTrace, and SystemTap.Read 4 Oct 2026 · bpftrace.org
Limit
The documentation says unstable features are subject to change or removal.Read 4 Oct 2026 · bpftrace.org
Operational limit
The default maximum number of probes is 1,024; increasing it can use more memory, increase startup time, and cause high overhead or system freezes or crashes.Read 3 Oct 2026 · bpftrace.org
Playground
The web playground notes that it does not yet support all bpftrace features.Read 4 Oct 2026 · bpftrace.org
Probe types
The documentation describes probes including kprobes, uprobes, and tracepoints.Read 4 Oct 2026 · bpftrace.org
Script imports
Scripts can import bpftrace files, C headers, BPF C source files, or supported files from a directory.Read 4 Oct 2026 · bpftrace.org
Scripting
Programs can be supplied as a file, inline with -e, or through standard input.Read 3 Oct 2026 · bpftrace.org
Security control
Helpers marked unsafe require the --unsafe flag to use.Read 3 Oct 2026 · bpftrace.org
Standard library
The standard library includes builtins, functions, macros, and map value functions.Read 3 Oct 2026 · bpftrace.org
System requirements
Some features require kernel headers, and BTF support for vmlinux requires Linux 4.18 or later with CONFIG_DEBUG_INFO_BTF enabled.Read 4 Oct 2026 · bpftrace.org
Tracing
It supports static and dynamic tracing for both the kernel and user space.Read 4 Oct 2026 · bpftrace.org
Tracing sources
It supports kernel and user-level dynamic tracing, perf events, USDT, uprobes, and tracepoints.Read 3 Oct 2026 · github.com

Plans and prices

bpftrace Free Open-source Linux tracing tool · requires a compatible Linux kernel and BPF support Read 4 Oct 2026 · github.com

Every bpftrace plan and price →

Strong points and limits

Strong points

  • Kernel and user-space tracing
  • Supports many probe types
  • Multiple script input methods
  • Broad architecture support
  • Package-manager installation options

Limits

  • Probe limit defaults to 1,024
  • Raising limits can cause high overhead or crashes
  • Some features require kernel headers
  • Unstable features may change or disappear

Who it suits

bpftrace suits Linux users and organizations doing kernel or application tracing, profiling, and debugging. It is self-hosted and requires compatible Linux kernel and BPF support.

Verdict

bpftrace offers a scriptable eBPF interface for Linux tracing across kernel and user space. Review kernel requirements and probe-limit risks before deploying it on production systems.

Where Specifiction places it

Alternatives to bpftraceAll alternatives →