BCC

What BCC is

BCC is a free, Apache-2.0-licensed toolkit for creating kernel tracing and manipulation programs with eBPF. It is designed for Linux and self-hosted use, with performance analysis and network traffic control among its stated applications. BCC provides kernel instrumentation in C, with Python and Lua front ends. Its workflow includes a shared library, an LLVM BPF backend for JIT, and dynamic loading and unloading of JITed programs. Supported kernel hooks include socket filters, tc classifiers, tc actions, and kprobes. The project includes standalone tracing tools with examples for disk I/O, processes, networking, and filesystems. Installation generally requires Linux kernel 4.1 or newer and specified kernel configuration options. Instructions or packages are listed for Debian, Ubuntu, Fedora, Arch, Gentoo, openSUSE, RHEL, Amazon Linux, Alpine Linux, and WSL. The guide cautions that Ubuntu Universe and iovisor BCC packages are outdated, and points to building from source for an up-to-date packaged version. The README describes eBPF programs as sandboxed bytecode executed by the kernel. For help, the project points users to its GitHub issue tracker, IOVisor mailing list, and #iovisor IRC channel.