Bpftrace for Linux 2018

Hi Brendan, thanks for the update and the work on this! Coming from dtrace, the main thing missing in bpftrace when doing kernel debugging is being able to navigate structs.<p>You&#x27;ve mentioned that we do have BTF now in Linux 4.18. I&#x27;ve tried to find if it was leveraged in bpftrace, but it looks like it isn&#x27;t yet. I see you&#x27;ve opened an issue in one of the bpftrace forks related to this here: <a href="https:&#x2F;&#x2F;github.com&#x2F;ajor&#x2F;bpftrace&#x2F;issues&#x2F;30" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ajor&#x2F;bpftrace&#x2F;issues&#x2F;30</a>.<p>Do you know if there&#x27;s been any update on this? Support for BTF&#x2F;CTF would be amazing.

This is huge. The Linux community should be glad that Netflix hired Brendan Gregg to work on Linux performance.

Seeing this come together makes me super happy.<p>Now the next time the hot rage of an audio xrun overcomes me I will have a path forward!<p>In general audio xruns actually is an area that could use a permanent userspace program.<p>Musicians need low latency audio processing which Jack2 can provide but the random xrun and the internet flimflam&#x2F;mummery of how to sort it out is waaaaay beyond most of us (I have less of an excuse but yah its a vibe killer when you are trying to make music).<p>The goal would be &quot;hey you had a&#x2F;some xrun and its might be mostly this disk or process or...&quot;<p>Maybe this needs hard ai but maybe it just needs a compass like tool...

This is a great update. I&#x27;d wondered how ply differed from bpftrace. And structs support is a huge step in achieving parity with DTrace.<p>DTrace has really helped me out* on macOS. To be without it is to lose a superpower, so I&#x27;m really rooting for bpftrace to bring the same tracing experience to Linux. I&#x27;ve been excitedly following bcc, too. It&#x27;s just the right tool for HTTP metrics. But my most basic experiments so far have failed, and I don&#x27;t know how to get support.<p>* DTrace is a real swiss army-knife. It seems intended for observing production systems, but I&#x27;ve found it indispensible for local development. The mysqld provider is great for tracing queries and perf. Opensnoop answers all sorts of questions. And DTrace saved a C++ project of mine: explaining a deadlock that would&#x27;ve otherwise spelled the end of the software. The most fun I&#x27;ve had is using the pid provider to hook text out of visual novels (in WiNE!).

Hey Brendan! Super exciting - I&#x27;m already updating some internal documentation to point people towards this :)<p>When are we getting a Linux performance engineering book with all the bpf&#x2F;bcc&#x2F;bpftrace stuff in it?

Is there any chance this tool or maybe a wrapper for it could get a higher level, less C-like syntax?

1. Obviously Linux-only. How is it DTrace 2.0?<p>2. That’s a staggering amount of NIH, from CTF to syntax. Why?

The 2 major problems (ie the Elefant in the room) compared to DTrace are missing:<p>1. security: eBPF still supports arrays and and is therefore inherently insecure to be used in the kernel. DTrace didn&#x27;t support that feature on purpose and not because they couldn&#x27;t do it. see spectre&#x2F;meltdown.<p>2. availability: eBPF probes only work within the kernel. DTrace extends the same interface to the libc level and the user space level. you can trace not only kernel calls, also lib calls and with its high-level language support (Java, python, perl, ruby,...) into userspace. Linux-only eBPF will never be able to support that seemless integration. thanksfully we now have Oracle Linux with proper DTrace support on Linux.