That already works! :) I wrote some MySQL examples in bcc that use the MySQL USDT probe points. Eg:
https://github.com/iovisor/bcc/blob/master/examples/tracing/...
https://github.com/iovisor/bcc/blob/master/examples/tracing/...
There's also a tool in /tools.
I'll whip up some PostgreSQL examples too (unless someone else beats me to it).
In DTrace for Linux 2016iovisor
bcc
C2016–2026
iovisor / bcc
bcc
BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
64Distinct people
78Mentions
0Explicit recommenders
22.7KGitHub stars
What to know before exploring
What it is
BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
GitHub
Where it is used
The last source check was inconclusive. This does not establish whether a product uses it.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- bpftrace/bpftrace · linked in 5 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 9:28:18 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year78 dated mentions
Observed mentions: 2016-02-03 15:03:57 UTC to 2026-08-10 08:04:42 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 16 | 6 | 10 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 10 | 0 | 10 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 13 | 4 | 9 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 7 | 1 | 6 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 6 | 0 | 6 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 8 | 1 | 7 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 2 | 0 | 2 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
BPF Compiler Collection (BCC)
BCC is a toolkit for creating efficient kernel tracing and manipulation
programs, and includes several useful tools and examples. It makes use of
extended BPF (Berkeley Packet Filters), formally known as eBPF, a new feature
that was first added to Linux 3.15. Much of what BCC uses requires Linux 4.1
and above.
eBPF was described by Ingo Molnár as:
One of the more interesting features in this cycle is the ability to attach eBPF programs (user-defined, sandboxed bytecode executed by the kernel) to kprobes. This allows user-defined instrumentation on a live kernel image that can never crash, hang or interfere with the kernel negatively.
BCC makes BPF programs easier to write, with kernel instrumentation in C
(and includes a C wrapper around LLVM), and front-ends in Python and lua.
It is suited for many tasks, including performance analysis and network
traffic control.
Screenshot
This example traces a disk I/O kernel function, and populates an in-kernel
power-of-2 histogram of the I/O size. For efficiency, only the histogram
summary is returned to user-level.
# ./bitehist.py
Tracing... Hit Ctrl-C to end.
^C
kbytes : count distribution
0 -> 1 : 3 | |
2 -> 3 : 0 | |
4 -> 7 : 211 |********** |
8 -> 15 : 0 | |
16 -> 31 : 0 | |
32 -> 63 : 0 | |
64 -> 127 : 1 | |
128 -> 255 : 800 |**************************************|
The above output shows a bimodal distribution, where the largest mode of
800 I/O was between 128 and 255 Kbytes in size.
See the source: bitehist.py. What this traces,
what this stores, and how the data is presented, can be entirely customized.
This shows only some of many possible capabilities.
Installing
See INSTALL.md for installation steps on your platform.
FAQ
See FAQ.txt for the most common troubleshoot questions.
Reference guide
See docs/reference_guide.md for the reference guide to the bcc and bcc/BPF APIs.
Contents
Some of these are single files that contain both C and Python, others have a
pair of .c and .py files, and some are directories of files.
Tracing
Examples
examples/tracing/bitehist.py: Block I/O size histogram. Examples.
examples/tracing/disksnoop.py: Trace block device I/O latency. Examples.
examples/hello_world.py: Prints "Hello, World!" for new processes.
examples/tracing/mysqld_query.py: Trace MySQL server queries using USDT probes. Examples.
examples/tracing/nodejs_http_server.py: Trace Node.js HTTP server requests using USDT probes. Examples.
examples/tracing/stacksnoop: Trace a kernel function and print all kernel stack traces. Examples.
tools/statsnoop: Trace stat() syscalls. Examples.
examples/tracing/task_switch.py: Count task switches with from and to PIDs.
examples/tracing/tcpv4connect.py: Trace TCP IPv4 active connections. Examples.
examples/tracing/trace_fields.py: Simple example of printing fields from traced events.
examples/tracing/undump.py: Dump UNIX socket packets. Examples
examples/tracing/urandomread.py: A kernel tracepoint example, which traces random:urandom_read. Examples.
examples/tracing/vfsreadlat.py examples/tracing/vfsreadlat.c: VFS read latency distribution. Examples.
examples/tracing/kvm_hypercall.py: Conditional static kernel tracepoints for KVM entry, exit and hypercall Examples.
Tools
tools/argdist: Display function parameter values as a histogram or frequency count. Examples.
tools/bashreadline: Print entered bash commands system wide. Examples.
tools/bpflist: Display processes with active BPF programs and maps. Examples.
tools/capable: Trace security capability checks. Examples.
tools/compactsnoop: Trace compact zone events with PID and latency. Examples.
tools/criticalstat: Trace and report long atomic critical sections in the kernel. Examples
tools/deadlock: Detect potential deadlocks on a running process. Examples.
tools/drsnoop: Trace direct reclaim events with PID and latency. Examples.
tools/funccount: Count kernel function calls. Examples.
tools/inject: Targeted error injection with call chain and predicates Examples.
tools/klockstat: Traces kernel mutex lock events and display locks statistics. Examples.
tools/opensnoop: Trace open() syscalls. Examples.
tools/readahead: Show performance of read-ahead cache Examples.
tools/reset-trace: Reset the state of tracing. Maintenance tool only. Examples.
tools/stackcount: Count kernel function calls and their stack traces. Examples.
tools/syncsnoop: Trace sync() syscall. Examples.
tools/threadsnoop: List new thread creation. Examples.
tools/tplist: Display kernel tracepoints or USDT probes and their formats. Examples.
tools/trace: Trace arbitrary functions, with filters. Examples.
tools/ttysnoop: Watch live output from a tty or pts device. Examples.
tools/ucalls: Summarize method calls or Linux syscalls in high-level languages. Examples.
tools/uflow: Print a method flow graph in high-level languages. Examples.
tools/ugc: Trace garbage collection events in high-level languages. Examples.
tools/uobjnew: Summarize object allocation events by object type and number of bytes allocated. Examples.
tools/ustat: Collect events such as GCs, thread creations, object allocations, exceptions and more in high-level languages. Examples.
tools/uthreads: Trace thread creation events in Java and raw pthreads. Examples.
Memory and Process Tools
tools/execsnoop: Trace new processes via exec() syscalls. Examples.
tools/exitsnoop: Trace process termination (exit and fatal signals). Examples.
tools/killsnoop: Trace signals issued by the kill() syscall. Examples.
tools/kvmexit: Display the exit_reason and its statistics of each vm exit. Examples.
tools/
Read the full README on GitHubWhat Hacker News says
16 sourcesIt wasn't mentioned in the article, but I've recently merged LuaJIT to BPF compiler. So you just write Lua and the kernel bits get compiled into BPF bytecode and loaded. No C.
See https://github.com/iovisor/bcc/blob/master/src/lua/README.md... or examples https://github.com/iovisor/bcc/blob/master/examples/lua/trac... (this one is for tracing).
In DTrace for Linux 2016Yes, see the section "A higher-level language", which mentions at least two projects: SystemTap+BPF and ply.
Think of the current bcc/Python/C interface as a lightweight skin that was necessary during BPF development to kick the tires on various features, prototype tools, see what else needed to be done, etc. It may be good enough to stay around, as lots of tools have been written for it that will get used and be valuable. But there's room for higher-level languages too.
If Sasha keeps developing his "trace" tool (and its summary counterpart, argdist), that may serve many such custom needs (as another option). See the various examples: https://github.com/iovisor/bcc/blob/master/tools/trace_examp... , like:
# trace 'sys_read (arg3 > 20000) "read %d bytes", arg3'
TIME PID COMM FUNC -
05:18:23 4490 dd
Read the rest
sys_read read 1048576 bytes
05:18:23 4490 dd sys_read read 1048576 bytes
05:18:23 4490 dd sys_read read 1048576 bytes
You only have to write the kernel stuff in C (which is a small part, since you are just collecting data), for the front end you can use BCC (Python/Lua)
https://github.com/iovisor/bcc
Personal favorite: https://github.com/iovisor/bcc/blob/master/tools/sslsniff_ex...
In What is BPF and why is it taking over Linux Performance Analysis?BCC – Tools for BPF-Based Linux Analysis
21 points · Open discussionI've DTrace'd qmax before -- pretty useful, back in the day of Solaris.
Linux is finally getting these superpowers too with BPF: https://github.com/iovisor/bcc#tools , which is great news for all of us running Linux.
In Kernel Tracing Qmax on Solaris – Part 2BCC – Tools for BPF-based Linux IO analysis, networking, monitoring, and more
2 points · Open discussionVery interesting possibility is compilation of P4 into BPF:
http://services.geant.net/GTS/Resources/PublishingImages/Pag...
http://openvswitch.org/support/slides/p4.pdf
https://github.com/iovisor/bcc/tree/master/src/cc/frontends/...
In P4: open-source programming language for high-performance packet switchingNew Lua(JIT) front end for bcc merged
4 points · Open discussionI assume BPF is Berkeley Packet Filters or maybe eBPF (Extended Berkeley Packet Filters) in this case. Just to save anyone else having to look this up. It looks like this is the link to the tools.
https://github.com/iovisor/bcc
https://en.wikipedia.org/wiki/Berkeley_Packet_Filter
In The Linux Scheduler: A Decade of Wasted Cores [pdf]Yes, I'm involved, and no, I don't think the current public release of Vector tackles many of the issues yet. But we've been working on them and will have it released when we can. Items include:
- PMCs: Vector's backend is pcp, which has a Linux perf_events pmda for PMC support. There's no PMC counters by default in Vector since we're using it in an environment without PMC access. But I've been heavily working in this area. More later on.
- Flame graph support: we already have it and use it. Ongoing work includes new flame graph types, and a rewritten flame graph implementation in d3. Need to get it all published.
- Heat map support: just solved an issue with them; again, an area where we have ad hoc tools that work and bring value, but haven't wrapped it all in Vector yet.
- BPF support: I've been prototyping many new metrics that we wan
Read the rest
t in Vector, https://github.com/iovisor/bcc#tools. There'll be increased demand to get Vector accessing these in a couple of months or so, when we have newer kernels in production that have BPF.
BCC – Tools for BPF-based Linux IO analysis, networking, monitoring, and more
3 points · Open discussionIf you browse some of the _example.txt files in https://github.com/iovisor/bcc/tree/master/tools , you'll see it's solving the same problems we used to solve with DTrace, plus a few extra. Here's a couple of the ZFS examples (since we're talking ZFS):
# ./zfsslower
Tracing ZFS operations slower than 10 ms
TIME COMM PID T BYTES OFF_KB LAT(ms) FILENAME
06:31:28 dd 25570 W 131072 38784 303.92 data1
06:31:34 dd 25686 W 131072 38784 388.28 data1
06:31:35 dd 25686 W 131072 78720 519.66 data1
06:31:35 dd 25686 W 131072 116992 405.94 data1
06:31:35 dd 25686 W 131072 153600 433.52 data1
[...]
# ./zfsdist
Tracing ZFS operation latency... Hit Ctrl-C to end.
^C
operation = 'read'
usecs : count
Read the rest
distribution
0 -> 1 : 0 | |
2 -> 3 : 0 | |
4 -> 7 : 4479 |****************************************|
8 -> 15 : 1028 |********* |
16 -> 31 : 14 | |
32 -> 63 : 1 | |
64 -> 127 : 2 | |
128 -> 255 : 6 | |
256 -> 511 : 1 | |
512 -> 1023 : 1256 |*********** |
1024 -> 2047 : 9 | |
2048 -> 4095 : 1 | |
4096 -> 8191 : 2 | |
[...]
The current BPF interface we're using (bcc) is Python for the frontend, and C for the backend. It's currently much more verbose than DTrace, and involves writing 10x the lines of code. For some immediate use cases at Netflix, that's not a big problem, as staff will be using BPF via a GUI (Vector), not writing these tools directly.
There's also high level features it's still missing (like tracepoints and sampling), so what will be in Ubuntu 14.04 won't do everything, but it will do a fair amount: most of those _example.txt's. Some use a newer BPF interface (linux 4.5), and we've been putting the legacy versions in an /old directory specifically for Ubuntu 16.04 users.
This is great news, and we're already using ZFS in production on Ubuntu in a few areas at Netflix (not widespread yet).
Ubuntu 16.04 also comes with enhanced BPF, the new Linux tracing & programming framework that is builtin to the kernel, and is a huge leap forward for Linux tracing. Eg, we can start using tools like these: https://github.com/iovisor/bcc#tracing
In ZFS is the FS for Containers in Ubuntu 16.04Showing the 15 most recent of 16 sources. Enable JavaScript to search and browse every indexed mention.