bpftrace
bpftrace is a free, self-hosted Linux tool and language for tracing activity in the kernel and user space with eBPF.
What bpftrace is
bpftrace is a free, self-hosted Linux tool and language for tracing activity in the kernel and user space with eBPF. It supports kprobes, uprobes, tracepoints, perf events, and USDT, making it useful for tracing and debugging across system and application activity. Scripts can be loaded from files, entered with `-e`, or piped through standard input. The language draws on awk, C, DTrace, and SystemTap; LLVM compiles scripts to eBPF bytecode, and the tool uses libbpf and bcc to work with Linux BPF. Its standard library includes builtins, functions, macros, and map value functions. Importing from world-writable directories is blocked, and helpers marked unsafe require `--unsafe`. The default ceiling is 1,024 probes; raising it can increase memory use and startup time or lead to high overhead, freezes, or crashes. Some features need kernel headers, and vmlinux BTF needs Linux 4.18 or later with CONFIG_DEBUG_INFO_BTF enabled. Supported architectures include x86_64, arm64, s390x, arm32, loongarch64, mips64, ppc64, and riscv64.
Good
- Free plan and self-hosted deployment.
- Traces kernel and user-space activity.
- Supports multiple probe and tracing sources.
- Scripts can be supplied in several ways.
- Supports eight listed architectures.
Watch out
- Requires Linux with compatible kernel and BPF support.
- Some features require kernel headers.
- Raising the 1,024-probe limit can risk system instability.
- Unstable features may change or be removed.
Who it suits
It suits Linux users who need kernel or user-space tracing for debugging and production workloads. Users should be comfortable with Linux kernel requirements and the operational risks of increasing the probe limit.
Verdict
bpftrace combines broad Linux tracing support with a scripting interface and no listed price. Check kernel requirements and probe-limit risks before using it on a system where stability is critical.
Plans and prices
From bpftrace's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| bpftrace | Free | Open-source Linux tracing tool · requires a compatible Linux kernel and BPF support |
The facts
Each one read from bpftrace's own pages, with the date it was checked.
What it does
- Architectures
- The documentation lists x86_64, arm64, s390x, arm32, loongarch64, mips64, ppc64, and riscv64 as supported architectures.checked 4 Oct 2026
- Compiler and libraries
- bpftrace uses LLVM as a compiler backend and libbpf to interact with the Linux BPF subsystem.checked 3 Oct 2026
- Implementation
- bpftrace uses LLVM to compile scripts to eBPF bytecode and uses libbpf and bcc to interact with Linux BPF.checked 4 Oct 2026
- Import security
- bpftrace refuses to import files from world-writable directories.checked 3 Oct 2026
- Installation
- The project README lists installation commands for several Linux distribution package managers, including apt, dnf, apk, pacman, emerge, and zypper.checked 3 Oct 2026
- Install options
- The project README lists package-manager installation commands for distributions including Ubuntu, Fedora, Alpine, Arch, Gentoo, Nix, and openSUSE.checked 4 Oct 2026
- Integration
- A community language server offers autocompletion, error diagnostics, and go-to-definition in editors that support LSP.checked 4 Oct 2026
- Intended users
- The project says its contributors, users, and organizations rely on it for production tracing and debugging.checked 3 Oct 2026
- Language
- The bpftrace language is inspired by awk, C, DTrace, and SystemTap.checked 4 Oct 2026
- Limit
- The documentation says unstable features are subject to change or removal.checked 4 Oct 2026
- Operational limit
- The default maximum number of probes is 1,024; increasing it can use more memory, increase startup time, and cause high overhead or system freezes or crashes.checked 3 Oct 2026
- Playground
- The web playground notes that it does not yet support all bpftrace features.checked 4 Oct 2026
- Probe types
- The documentation describes probes including kprobes, uprobes, and tracepoints.checked 4 Oct 2026
- Purpose
- bpftrace is a high-level tracing language for Linux for writing observability-based eBPF programs.checked 4 Oct 2026
- Script imports
- Scripts can import bpftrace files, C headers, BPF C source files, or supported files from a directory.checked 4 Oct 2026
- Scripting
- Programs can be supplied as a file, inline with -e, or through standard input.checked 3 Oct 2026
- Security
- As a security measure, bpftrace refuses to import files from world-writable directories.checked 4 Oct 2026
- Security control
- Helpers marked unsafe require the --unsafe flag to use.checked 3 Oct 2026
- Standard library
- The standard library includes builtins, functions, macros, and map value functions.checked 3 Oct 2026
- Support
- The project README lists GitHub Discussions, the issue tracker, monthly office hours, and Discord as ways to get help or participate.checked 4 Oct 2026
- System requirements
- Some features require kernel headers, and BTF support for vmlinux requires Linux 4.18 or later with CONFIG_DEBUG_INFO_BTF enabled.checked 4 Oct 2026
- Tracing
- It supports static and dynamic tracing for both the kernel and user space.checked 4 Oct 2026
- Tracing sources
- It supports kernel and user-level dynamic tracing, perf events, USDT, uprobes, and tracepoints.checked 3 Oct 2026
Alternatives to bpftrace
- 1
Coroot
Free planOpen sourceWebAPILinuxSelf-hosted8.2From $1 a month - 2
Kubeshark
Free planOpen sourceWebAPILinuxmacOS8.1From $0.40 a month - 3
Metoro Kubernetes Profiling
Free planWebAPILinuxSelf-hosted7.5From $20 a month - 4
groundcover
Free planWebLinuxSelf-hosted7.1From $30 a month - 5
DeepFlow
Free planAndroidWebAPILinux6.7Free plan - 6
Pyroscope
Free planWebLinuxmacOSWindows6.7From $19 a month