bpftrace vs Retina
bpftrace
bpftrace.orgRetina
retina.shSide by side
| Figure | bpftrace | Retina |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 0 |
| Spec score · eBPF Observability Tools | 8.6 (#4) | 7.0 (#26) |
| Intended users | The project says its contributors, users, and organizations rely on it for production tracing and debugging. | Retina is aimed at cluster network administrators, cluster security administrators, and DevOps engineers working on DevOps, SecOps, and compliance use cases. |
| Security | As a security measure, bpftrace refuses to import files from world-writable directories. | The project states that Retina images published to GHCR are cryptographically signed and provides cosign verification instructions. |
| Support | The project README lists GitHub Discussions, the issue tracker, monthly office hours, and Discord as ways to get help or participate. | The project directs bug reports and feature requests to GitHub issues and lists [email protected] for other maintainer contact. |
Plans
In their own words
bpftrace
bpftrace is a free, high-level tracing language and general-purpose Linux tracing tool built on eBPF. It supports kernel and user-space dynamic tracing, perf events, USDT, uprobes, and tracepoints. Its language draws from awk, C, DTrace, and SystemTap. Programs can come from files, inline -e input, or standard input, and the standard library supplies builtins, functions, macros, and map-value functions. LLVM compiles scripts to eBPF bytecode; libbpf interacts with Linux’s BPF subsystem, with bcc also used in the implementation. Scripts can import bpftrace files, C headers, BPF C source, and supported directory files. Unsafe helpers require --unsafe, and imports from world-writable directories are refused. The default probe maximum is 1,024; increasing it can raise memory use, startup time, overhead, or risk freezes and crashes. Supported architectures include x86_64, arm64, s390x, arm32, loongarch64, mips64, ppc64, and riscv64. Some features need kernel headers; vmlinux BTF needs Linux 4.18 or later with CONFIG_DEBUG_INFO_BTF enabled.