bpftrace

Hi Brendan, thanks for the update and the work on this! Coming from dtrace, the main thing missing in bpftrace when doing kernel debugging is being able to navigate structs. You've mentioned that we do have BTF now in Linux 4.18. I've tried to find if it was leveraged in bpftrace, but it looks like it isn't yet. I see you've opened an issue in one of the bpftrace forks related to this here: https://github.com/ajor/bpftrace/issues/30. Do you know if there's been any update on this? Support for BTF/CTF would be amazing.

# funclatency -i 10 -p `pgrep -n mysqld` sys_write Whoops, that was easy. I think argdist can do this as well. I'd have picked a different one-liner. It's not hard to come up with DTrace one-liners that are currently horribly hard with eBPF and bcc. Which is why I said we could have DTrace's D as a front end to bcc/eBPF. Or the bpftrace project will do that, and already has similar one-liners. Check it out[1]. Either way, we win. It's the kernel eBPF code that is more featured. It's great that Oracle is doing more with open source, and we may use some user level components, but Linux already has eBPF in the kernel now. [1] https://github.com/ajor/bpftrace

eBPF lacks a high level front end, in part because that's optional. Engineering effort has gone into the essentials first: kernel development of eBPF, basic user-level frameworks to use it (bcc), and lots and lots of testing and bug fixes to make that rock solid. bcc is not as easy to code in, but I've been able to port over many of my DTraceToolkit scripts already. We're only more recently looking at higher level languages, as a nice to have. Here's one project: https://github.com/ajor/bpftrace We can also look at taking the /usr/sbin/dtrace code (licenses permitting), and calling into libbcc and emitting BPF bytecode. That'd give us a D language front-end to BPF, so I can run my old DTrace scripts directly (plus sell more copies of my DTrace book -- I joke ;-) Help on either of those projects would be appreciated (bpftrace or DTrace-BPF