{"slug": "bpftrace", "name": "bpftrace", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "", "recommenders": 3, "commenters": 5, "warners": 0, "score": 3.086, "rising": -0.98, "first": "2025-11-01", "latest": "2026-07-26", "why": "that you can track using bpftrace which gives you better diagnostics", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 2, "compare": 0, "warn": 0}, "spark": [1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "that you can track using bpftrace which gives you better diagnostics", "kind": "", "icon": false, "domain": "bpftrace.org", "github_repo": null, "official_url": "https://bpftrace.org", "pricing": "", "aliases": ["bpftrace"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 785038834, "item_id": 49064927, "url": "https://news.ycombinator.com/item?id=49064927", "by": "Chu4eeno", "date": "2026-07-26", "version": null, "stance": "recommend", "quote": "maybe try bpftrace, DTrace or SystemTap", "excerpt": "It sounds like Wayland. When you decide to suddenly stuff some of the most complex pieces of software together (the X server and the compositor which sometimes also double as a desktop shell) into giant codebase/process with seemingly no proper plan or roadmap and make up the specification along the way (or just don't, wayland still has no proper XACE replacement, so kiosk tooling etc. is ad-hoc), you get Wayland in ", "context": "", "use_case": "", "switched_from": "", "story": "Nothing works and everyone is euphoric"}, {"id": 761109184, "item_id": 47569324, "url": "https://news.ycombinator.com/item?id=47569324", "by": "bruce_one", "date": "2026-03-29", "version": null, "stance": "recommend", "quote": "e.g. [bpftrace](https://bpftrace.org) has an [execsnoop]", "excerpt": "eBPF is a great tool to use for debugging this kind of thing too, e.g. [bpftrace](https://bpftrace.org) has an [execsnoop](https://github.com/bpftrace/bpftrace/blob/master/tools/execsnoop.bt) script for looking at everything being exec'd on the system :-) (No need to use bpftrace, just an easy example :-) )", "context": "", "use_case": "tracing exec calls", "switched_from": "", "story": "Claude Code runs Git reset \u2013hard origin/main against project repo every 10 mins"}, {"id": 733198753, "item_id": 45824922, "url": "https://news.ycombinator.com/item?id=45824922", "by": "cptnntsoobv", "date": "2025-11-05", "version": null, "stance": "recommend", "quote": "that you can track using bpftrace which gives you better diagnostics", "excerpt": "XDP, and the eBPF ecosystem in general, is quite neat. However, a word of caution: * The BPF verifier's DX is not great yet. If it finds problems with your BPF code it will spit our a rather inscrutable set of error messages that often requires a good understanding of the verifier internals (e.g the register nomenclature) to debug * For the same source code, the code generated by the verifier can change across compil", "context": "", "use_case": "Kernel packet-drop debugging", "switched_from": "", "story": "An eBPF loophole: Using XDP for egress traffic"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["tracing exec calls", "kernel packet-drop debugging"], "compared": [{"slug": "strace", "name": "strace", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "dtrace", "name": "DTrace", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=45786190", "title": "Diffwatch \u2013 Watch AI agents touch the FS and see diffs live", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=49033004", "title": "Nothing works and everyone is euphoric", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47567969", "title": "Claude Code runs Git reset \u2013hard origin/main against project repo every 10 mins", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=45812756", "title": "An eBPF loophole: Using XDP for egress traffic", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 2, "recommend": 1}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {"recommend": 1}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {"recommend": 1}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "quotes": [{"id": 785038834, "item_id": 49064927, "url": "https://news.ycombinator.com/item?id=49064927", "by": "Chu4eeno", "date": "2026-07-26", "version": null, "stance": "recommend", "quote": "maybe try bpftrace, DTrace or SystemTap", "excerpt": "It sounds like Wayland. When you decide to suddenly stuff some of the most complex pieces of software together (the X server and the compositor which sometimes also double as a desktop shell) into giant codebase/process with seemingly no proper plan or roadmap and make up the specification along the way (or just don't, wayland still has no proper XACE replacement, so kiosk tooling etc. is ad-hoc), you get Wayland in ", "context": "", "use_case": "", "switched_from": "", "story": "Nothing works and everyone is euphoric"}, {"id": 761109184, "item_id": 47569324, "url": "https://news.ycombinator.com/item?id=47569324", "by": "bruce_one", "date": "2026-03-29", "version": null, "stance": "recommend", "quote": "e.g. [bpftrace](https://bpftrace.org) has an [execsnoop]", "excerpt": "eBPF is a great tool to use for debugging this kind of thing too, e.g. [bpftrace](https://bpftrace.org) has an [execsnoop](https://github.com/bpftrace/bpftrace/blob/master/tools/execsnoop.bt) script for looking at everything being exec'd on the system :-) (No need to use bpftrace, just an easy example :-) )", "context": "", "use_case": "tracing exec calls", "switched_from": "", "story": "Claude Code runs Git reset \u2013hard origin/main against project repo every 10 mins"}, {"id": 733198753, "item_id": 45824922, "url": "https://news.ycombinator.com/item?id=45824922", "by": "cptnntsoobv", "date": "2025-11-05", "version": null, "stance": "recommend", "quote": "that you can track using bpftrace which gives you better diagnostics", "excerpt": "XDP, and the eBPF ecosystem in general, is quite neat. However, a word of caution: * The BPF verifier's DX is not great yet. If it finds problems with your BPF code it will spit our a rather inscrutable set of error messages that often requires a good understanding of the verifier internals (e.g the register nomenclature) to debug * For the same source code, the code generated by the verifier can change across compil", "context": "", "use_case": "Kernel packet-drop debugging", "switched_from": "", "story": "An eBPF loophole: Using XDP for egress traffic"}, {"id": 732617698, "item_id": 45788606, "url": "https://news.ycombinator.com/item?id=45788606", "by": "deemkeen", "date": "2025-11-02", "version": null, "stance": "neutral", "quote": "Linux: eBPF/bpftrace when available", "excerpt": "Thanks for the thoughtful pointers \u2014 super helpful. Where diffwatch is today: it\u2019s a portable directory watcher (fsnotify \u2192 inotify/FSEvents/ReadDirectoryChangesW) that coalesces events and renders live unified diffs in a tiny TUI. What I\u2019m planning based on your suggestions (and others here): 1. Two-tier design Default (no admin): keep the current directory-watch mode for quick, portable use. Power mode (attach): di", "context": "", "use_case": "", "switched_from": "", "story": "Diffwatch \u2013 Watch AI agents touch the FS and see diffs live"}, {"id": 732593601, "item_id": 45787100, "url": "https://news.ycombinator.com/item?id=45787100", "by": "westurner", "date": "2025-11-01", "version": null, "stance": "neutral", "quote": "from bpftrace or dtrace stdout", "excerpt": "np. there's a diagram, \"Linux bcc/BPF tracing tools\" [-1] in the bcc readme [0] that's also in [1] which explains ebpf and bcc and bpftrace. filetop, dirtop, and vfsstat use bpf to trace the VFS layer. [4] [-1] \"Linux bcc/BPF tracing tools\" https://www.brendangregg.com/BPF/bcc_tracing_tools_early2019.png [0] iovisor/bcc: https://github.com/iovisor/bcc [1] \"Linux Extended BPF (eBPF) Tracing Tools\", Dtrace book: https:", "context": "", "use_case": "", "switched_from": "", "story": "Diffwatch \u2013 Watch AI agents touch the FS and see diffs live"}, {"id": 732589761, "item_id": 45786860, "url": "https://news.ycombinator.com/item?id=45786860", "by": "westurner", "date": "2025-11-01", "version": null, "stance": "neutral", "quote": "Then with just bpftrace on Linux", "excerpt": "On MacOS: sudo dtrace -n 'vfs::*:entry { printf(\"%-16s %-6d %s\", execname, pid, probefunc); }' sudo dtrace -n 'vfs:lookup:entry { printf(\"%-16s %-6d %s\", execname, pid, copyinstr(arg1)); }' TIL Dtrace is included in recent builds of Windows 11 and Server 2025: https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace ; # Must be run as Administrator dtrace -n \"syscall::NtCreateFile:entry, syscall::NtR", "context": "", "use_case": "", "switched_from": "", "story": "Diffwatch \u2013 Watch AI agents touch the FS and see diffs live"}]}