bpftrace vs Kerno
bpftrace
bpftrace.orgKerno
github.comSide by side
| Figure | bpftrace | Kerno |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 0 |
| Spec score · eBPF Observability Tools | 8.6 (#4) | 7.0 (#25) |
| Purpose | bpftrace is a high-level tracing language for Linux for writing observability-based eBPF programs. | Kerno is an eBPF-based incident diagnosis engine for production issues across Linux, Kubernetes, VMs, and bare metal. |
| Security | As a security measure, bpftrace refuses to import files from world-writable directories. | The project says Kerno makes no outbound network calls by default and that AI integration is opt-in through the configured provider. |
| Support | The project README lists GitHub Discussions, the issue tracker, monthly office hours, and Discord as ways to get help or participate. | The security policy directs general questions to GitHub Discussions and vulnerability reports to [email protected], with acknowledgment targeted within 48 hours. |
| Tracing | It supports static and dynamic tracing for both the kernel and user space. | Kerno supports syscall latency, disk I/O latency, and CPU scheduler delay tracing. |
Plans
In their own words
bpftrace
bpftrace is a free, high-level tracing language and general-purpose Linux tracing tool built on eBPF. It supports kernel and user-space dynamic tracing, perf events, USDT, uprobes, and tracepoints. Its language draws from awk, C, DTrace, and SystemTap. Programs can come from files, inline -e input, or standard input, and the standard library supplies builtins, functions, macros, and map-value functions. LLVM compiles scripts to eBPF bytecode; libbpf interacts with Linux’s BPF subsystem, with bcc also used in the implementation. Scripts can import bpftrace files, C headers, BPF C source, and supported directory files. Unsafe helpers require --unsafe, and imports from world-writable directories are refused. The default probe maximum is 1,024; increasing it can raise memory use, startup time, overhead, or risk freezes and crashes. Supported architectures include x86_64, arm64, s390x, arm32, loongarch64, mips64, ppc64, and riscv64. Some features need kernel headers; vmlinux BTF needs Linux 4.18 or later with CONFIG_DEBUG_INFO_BTF enabled.