bpftrace

Free plan LinuxSelf-hosted

What bpftrace is

bpftrace is a free, open-source tracing language and general-purpose tracing tool for Linux systems that use eBPF. It supports dynamic tracing in both kernel and user space, as well as perf events, USDT, uprobes, and tracepoints. Its language draws on ideas from awk, C, DTrace, and SystemTap, and programs can be run from a file, entered inline with -e, or supplied through standard input. The standard library includes builtins, functions, macros, and map value functions. LLVM compiles scripts into eBPF bytecode; bpftrace uses libbpf and bcc to interact with Linux's BPF subsystem. Scripts can import bpftrace files, C headers, and BPF C source files, as well as supported files from a directory. Helpers marked unsafe require the --unsafe flag, and imports from world-writable directories are refused. The default maximum is 1,024 probes. Raising it can increase memory use and startup time, cause high overhead, or lead to system freezes or crashes. bpftrace is self-hosted, and its documentation lists multiple supported architectures. Some features require kernel headers; vmlinux BTF support requires Linux 4.18 or later with CONFIG_DEBUG_INFO_BTF enabled.

Who it suits

bpftrace suits Linux developers and operators who need to trace or debug activity in the kernel and user space. It is also intended for users and organizations that rely on production tracing, provided their systems have a compatible Linux kernel and BPF support.

What it does well

Free and open source.
Supports tracing in both kernel and user space.
Offers probes including kprobes, uprobes, and tracepoints.
Scripts can be run from files, inline, or standard input.
Supports eight listed processor architectures.
Package-manager installation commands are listed for multiple Linux distributions.

What to know first

Requires Linux with a compatible kernel and BPF support.
Some features require kernel headers.
Raising the default probe limit can cause high overhead, freezes, or crashes.
Unstable features may change or be removed.

Limits

bpftrace is free, with no paid plan listed. Its default maximum is 1,024 probes; raising that limit can increase memory use and startup time, create high overhead, or cause freezes or crashes. Some features require kernel headers, and vmlinux BTF support requires Linux 4.18 or later with CONFIG_DEBUG_INFO_BTF enabled.

Plans

Plan	Billed and limits	Price
bpftrace	Open-source Linux tracing tool · requires a compatible Linux kernel and BPF support	Free

As bpftrace.org lists them, read 4 Oct 2026. The maker's own page has the final word.

Getting started

Visit the bpftrace website and follow the installation instructions for your Linux distribution.
Install bpftrace using a listed package manager.
Run a program from a script file, provide it inline with -e, or pass it through standard input.
Check kernel headers or BTF requirements for the features you plan to use.

Verdict

Choose bpftrace if you need a free Linux tool for tracing kernel and user-space activity through eBPF. Look elsewhere if you need a tool for another operating system or cannot meet its kernel and BPF requirements.

Questions

How much does bpftrace cost?

bpftrace is free and open source.

Which operating systems does bpftrace support?

It supports Linux. It requires a compatible Linux kernel and BPF support.

Is bpftrace self-hosted?

Yes. bpftrace is self-hosted and runs on Linux systems.

Which processor architectures are supported?

The documentation lists x86_64, arm64, s390x, arm32, loongarch64, mips64, ppc64, and riscv64.

Does bpftrace require special kernel support?

It requires a compatible Linux kernel and BPF support. Some features require kernel headers; vmlinux BTF requires Linux 4.18 or later with CONFIG_DEBUG_INFO_BTF enabled.

Where can users get help?

The project points users to GitHub Discussions, its issue tracker, monthly office hours, and Discord.

Facts from bpftrace's own pages

Architectures: The documentation lists x86_64, arm64, s390x, arm32, loongarch64, mips64, ppc64, and riscv64 as supported architectures. · bpftrace.org, 4 Oct 2026
Compiler and libraries: bpftrace uses LLVM as a compiler backend and libbpf to interact with the Linux BPF subsystem. · github.com, 3 Oct 2026
Implementation: bpftrace uses LLVM to compile scripts to eBPF bytecode and uses libbpf and bcc to interact with Linux BPF. · bpftrace.org, 4 Oct 2026
Import security: bpftrace refuses to import files from world-writable directories. · bpftrace.org, 3 Oct 2026
Installation: The project README lists installation commands for several Linux distribution package managers, including apt, dnf, apk, pacman, emerge, and zypper. · github.com, 3 Oct 2026
Install options: The project README lists package-manager installation commands for distributions including Ubuntu, Fedora, Alpine, Arch, Gentoo, Nix, and openSUSE. · github.com, 4 Oct 2026
Integration: A community language server offers autocompletion, error diagnostics, and go-to-definition in editors that support LSP. · bpftrace.org, 4 Oct 2026
Intended users: The project says its contributors, users, and organizations rely on it for production tracing and debugging. · github.com, 3 Oct 2026
Language: The bpftrace language is inspired by awk, C, DTrace, and SystemTap. · bpftrace.org, 4 Oct 2026
Limit: The documentation says unstable features are subject to change or removal. · bpftrace.org, 4 Oct 2026
Operational limit: The default maximum number of probes is 1,024; increasing it can use more memory, increase startup time, and cause high overhead or system freezes or crashes. · bpftrace.org, 3 Oct 2026
Playground: The web playground notes that it does not yet support all bpftrace features. · bpftrace.org, 4 Oct 2026
Probe types: The documentation describes probes including kprobes, uprobes, and tracepoints. · bpftrace.org, 4 Oct 2026
Purpose: bpftrace is a high-level tracing language for Linux for writing observability-based eBPF programs. · bpftrace.org, 4 Oct 2026
Script imports: Scripts can import bpftrace files, C headers, BPF C source files, or supported files from a directory. · bpftrace.org, 4 Oct 2026
Scripting: Programs can be supplied as a file, inline with -e, or through standard input. · bpftrace.org, 3 Oct 2026
Security: As a security measure, bpftrace refuses to import files from world-writable directories. · bpftrace.org, 4 Oct 2026
Security control: Helpers marked unsafe require the --unsafe flag to use. · bpftrace.org, 3 Oct 2026
Standard library: The standard library includes builtins, functions, macros, and map value functions. · bpftrace.org, 3 Oct 2026
Support: The project README lists GitHub Discussions, the issue tracker, monthly office hours, and Discord as ways to get help or participate. · github.com, 4 Oct 2026
System requirements: Some features require kernel headers, and BTF support for vmlinux requires Linux 4.18 or later with CONFIG_DEBUG_INFO_BTF enabled. · bpftrace.org, 4 Oct 2026
Tracing: It supports static and dynamic tracing for both the kernel and user space. · bpftrace.org, 4 Oct 2026
Tracing sources: It supports kernel and user-level dynamic tracing, perf events, USDT, uprobes, and tracepoints. · github.com, 3 Oct 2026

Where bpftrace stands on Freedom251

eBPF Observability Tools#7 of 29