• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer navigation

The Geek Diary

  • OS
    • Linux
    • CentOS/RHEL
    • VCS
  • Interview Questions
  • Database
    • MariaDB
  • DevOps
    • Docker
    • Shell Scripting
  • Big Data
    • Hadoop
    • Cloudera
    • Hortonworks HDP

bpftrace: command not found

by admin

bpftrace is a command-line utility in Linux that is used to write and execute eBPF (enhanced Berkeley Packet Filter) programs for tracing and performance analysis. BPF is a powerful and flexible feature in the Linux kernel that allows you to apply custom filters to network traffic and perform various actions based on the contents of the packets.

If you encounter the below error while running the bftrace command:

bpftrace: command not found

you may try installing the below package as per your choice of distribution:

$ sudo apt-get install -y bpftrace     ## ubuntu
$ sudo dnf install -y bpftrace         ## Fedora
$ sudo emerge -av bpftrace             ## Gentoo
$ sudo pacman -S bpftrace              ## Arch Linux
$ sudo apk add bpftrace                ## Alpine

bpftrace Command Examples

1. Display bpftrace version:

# bpftrace -V

2. List all available probes:

# bpftrace -l

3. Run a one-liner program (e.g. syscall count by program):

# bpftrace -e 'tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }'

4. Run a program from a file:

# bpftrace path/to/file

5. Trace a program by PID:

# bpftrace -e 'tracepoint:raw_syscalls:sys_enter /pid == 123/ { @[comm] = count(); }'

6. Do a dry run and display the output in eBPF format:

# bpftrace -d -e 'one_line_program'

One-liners

The following one-liners demonstrate different capabilities:

1. Files opened by process:

# bpftrace -e 'tracepoint:syscalls:sys_enter_open { printf("%s %s\n", comm, str(args->filename)); }'

2. Syscall count by program:

# bpftrace -e 'tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }'

3. Read bytes by process:

# bpftrace -e 'tracepoint:syscalls:sys_exit_read /args->ret/ { @[comm] = sum(args->ret); }'

4. Read size distribution by process:

# bpftrace -e 'tracepoint:syscalls:sys_exit_read { @[comm] = hist(args->ret); }'

5. Show per-second syscall rates:

# bpftrace -e 'tracepoint:raw_syscalls:sys_enter { @ = count(); } interval:s:1 { print(@); clear(@); }'

6. Trace disk size by process:

# bpftrace -e 'tracepoint:block:block_rq_issue { printf("%d %s %d\n", pid, comm, args->bytes); }'

7. Count page faults by process:

# bpftrace -e 'software:faults:1 { @[comm] = count(); }'

8. Count LLC cache misses by process name and PID (uses PMCs):

# bpftrace -e 'hardware:cache-misses:1000000 { @[comm, pid] = count(); }'

9. Profile user-level stacks at 99 Hertz, for PID 189:

# bpftrace -e 'profile:hz:99 /pid == 189/ { @[ustack] = count(); }'

10. Files opened, for processes in the root cgroup-v2:

# bpftrace -e 'tracepoint:syscalls:sys_enter_openat /cgroup == cgroupid("/sys/fs/cgroup/unified/mycg")/ { printf("%s\n", str(args->filename)); }'

Filed Under: Linux

Some more articles you might also be interested in …

  1. debugfs Command Examples in Linux
  2. ipcrm Command Examples in Linux
  3. How to burn an ISO to CD or DVD using Wodim
  4. hcitool: command not found
  5. “git stage” Command Examples
  6. chfn Command Examples in Linux
  7. as Command Examples in Linux
  8. dig: DNS lookup utility
  9. rc-status Command Examples in Linux
  10. “uname” Command Examples to Check UNIX/Linux Version

You May Also Like

Primary Sidebar

Recent Posts

  • Vanilla OS 2 Released: A New Era for Linux Enthusiasts
  • mk Command Examples
  • mixxx Command Examples
  • mix Command Examples

© 2025 · The Geek Diary

  • Archives
  • Contact Us
  • Copyright