1
probe[,probe...] [if (filter)] { action }

1
# 统计每个进程的系统调用次数
2
sudo bpftrace -e '
3
tracepoint:raw_syscalls:sys_enter {
4
    @syscalls[comm] = count();
5
}'
6

7
# 追踪文件打开，按进程统计
8
sudo bpftrace -e '
9
tracepoint:syscalls:sys_enter_openat {
10
    @opens[comm] = count();
11
}'
12

13
# I/O 延迟直方图
14
sudo bpftrace -e '
15
kprobe:vfs_read { @start[tid] = nsecs; }
16
kretprobe:vfs_read /@start[tid]/ {
17
    @latency = hist(nsecs - @start[tid]);
18
    delete(@start[tid]);
19
}'
20

21
# 追踪 TCP 连接延迟
22
sudo bpftrace -e '
23
kprobe:tcp_v4_connect { @start[tid] = nsecs; }
24
kretprobe:tcp_v4_connect /@start[tid]/ {
25
    @connect_ns = hist(nsecs - @start[tid]);
26
    delete(@start[tid]);
27
}'
28

29
# 火焰图数据采集
30
sudo bpftrace -e '
31
profile:hz:99 {
32
    @[ustack()] = count();
33
}'

1
# 定期打印并清空 Map
2
sudo bpftrace -e '
3
tracepoint:raw_syscalls:sys_enter {
4
    @syscalls[comm] = count();
5
}
6
interval:s:5 {
7
    print(@syscalls);
8
    clear(@syscalls);
9
}'
10

11
# 打印后不清空（累计值）
12
sudo bpftrace -e '
13
kprobe:vfs_read {
14
    @bytes[comm] = sum(retval);
15
}
16
interval:s:10 {
17
    print(@bytes);
18
}'

1
#!/usr/bin/env python3
2
"""追踪进程执行，过滤指定父进程"""
3

4
from bcc import BPF
5
import argparse
6

7
# eBPF C 代码
8
bpf_text = """
9
#include <uapi/linux/ptrace.h>
10

11
struct event {
12
    u32 pid;
13
    u32 ppid;
14
    char comm[16];
15
    char filename[256];
16
};
17

18
BPF_RINGBUF(events);
19

20
TRACEPOINT_PROBE(sched, sched_process_exec) {
21
    struct event *e = events.ringbuf_reserve(sizeof(*e));
22
    if (!e) return 0;
23

24
    e->pid = bpf_get_current_pid_tgid() >> 32;
25
    e->ppid = PPID_FILTER;  // 运行时替换
26

27
    bpf_get_current_comm(&e->comm, sizeof(e->comm));
28
    bpf_probe_read_kernel_str(&e->filename, sizeof(e->filename),
29
                              args->filename);
30

31
    events.ringbuf_submit(e, 0);
32
    return 0;
33
}
34
"""
35

36
# 解析参数
37
parser = argparse.ArgumentParser()
38
parser.add_argument("--ppid", type=int, default=0)
39
args = parser.parse_args()
40

41
# 替换过滤器
42
bpf_text = bpf_text.replace("PPID_FILTER", str(args.ppid))
43

44
# 加载 eBPF 程序
45
b = BPF(text=bpf_text)
46

47
# 事件回调
48
def handle_event(cpu, data, size):
49
    event = b["events"].event(data)
50
    print(f"PID={event.pid} PPID={event.ppid} "
51
          f"COMM={event.comm.decode()} FILE={event.filename.decode()}")
52

53
b["events"].open_ring_buffer(handle_event)
54

55
print("Tracing process exec... Hit Ctrl-C to end")
56

57
while True:
58
    try:
59
        b.ring_buffer_consume()
60
    except KeyboardInterrupt:
61
        break

1
# 追踪所有进程执行
2
sudo /usr/share/bcc/tools/execsnoop
3

4
# 追踪文件打开
5
sudo /usr/share/bcc/tools/opensnoop
6

7
# I/O 延迟直方图
8
sudo /usr/share/bcc/tools/biolatency
9

10
# TCP 连接生命周期
11
sudo /usr/share/bcc/tools/tcplife
12

13
# 内存泄漏检测（追踪 malloc/free 不匹配）
14
sudo /usr/share/bcc/tools/memleak -p 1234
15

16
# CPU 火焰图
17
sudo /usr/share/bcc/tools/profile -F 99 -f > out.stacks

1
# Beyla 部署配置
2
apiVersion: v1
3
kind: ConfigMap
4
metadata:
5
  name: beyla-config
6
data:
7
  beyla-config.yml: |
8
    open_telemetry:
9
      traces:
10
        endpoint: "http://otel-collector:4318/v1/traces"
11
      metrics:
12
        endpoint: "http://otel-collector:4318/v1/metrics"
13
    discovery:
14
      services:
15
        - name: myapp
16
          namespace: default
17
          instrumentations: [http]
18
---
19
apiVersion: apps/v1
20
kind: DaemonSet
21
metadata:
22
  name: beyla
23
spec:
24
  selector:
25
    matchLabels:
26
      app: beyla
27
  template:
28
    spec:
29
      containers:
30
      - name: beyla
31
        image: grafana/beyla:latest
32
        securityContext:
33
          capabilities:
34
            add: ["CAP_BPF", "CAP_PERFMON", "CAP_SYS_RESOURCE"]
35
        volumeMounts:
36
        - name: config
37
          mountPath: /etc/beyla
38
      volumes:
39
      - name: config
40
        configMap:
41
          name: beyla-config

1
# CPU 分析
2
sudo bpftrace -e 'profile:hz:99 { @[ustack()] = count(); }'  # 火焰图
3
sudo /usr/share/bcc/tools/offcputime  # 离 CPU 时间
4

5
# 内存分析
6
sudo /usr/share/bcc/tools/memleak -p <pid>  # 内存泄漏
7
sudo bpftrace -e 'kprobe:kmalloc { @size[comm] = hist(arg1); }'  # 分配大小
8

9
# I/O 分析
10
sudo /usr/share/bcc/tools/biolatency  # I/O 延迟
11
sudo /usr/share/bcc/tools/biosnoop    # I/O 事件
12

13
# 网络分析
14
sudo /usr/share/bcc/tools/tcplife     # TCP 连接生命周期
15
sudo /usr/share/bcc/tools/tcpretrans  # TCP 重传
16
sudo bpftrace -e 'kprobe:tcp_drop { printf("drop: %s\n", comm); }'  # 丢包

1
# 采样 CPU 调用栈（99 Hz）
2
sudo bpftrace -e 'profile:hz:99 { @[ustack()] = count(); }' > cpu.stacks
3

4
# 生成火焰图（使用 FlameGraph 工具）
5
git clone https://github.com/brendangregg/FlameGraph
6
sudo bpftrace -e 'profile:hz:99 { @[ustack()] = count(); }' | \
7
    ./FlameGraph/stackcollapse-bpftrace.pl | \
8
    ./FlameGraph/flamegraph.pl > cpu.svg

1
# I/O 延迟直方图
2
sudo /usr/share/bcc/tools/biolatency
3
#     usecs           : count    distribution
4
#         0 -> 1       : 0        |                                        |
5
#         2 -> 3       : 0        |                                        |
6
#         4 -> 7       : 0        |                                        |
7
#         8 -> 15      : 12       |********                                |
8
#        16 -> 31      : 45       |*****************************           |
9
#        32 -> 63      : 89       |************************************************|
10
#        64 -> 127     : 23       |***************                         |
11

12
# I/O Top
13
sudo /usr/share/bcc/tools/biotop

1
# Docker 部署 Beyla
2
docker run -d --name beyla \
3
    --pid=host \
4
    --cap-add=CAP_BPF \
5
    --cap-add=CAP_PERFMON \
6
    -e BEYLA_OPEN_TELEMETRY_TRACES_ENDPOINT=http://otel:4318/v1/traces \
7
    -e BEYLA_DISCOVERY_SERVICES_0_NAME=myapp \
8
    -e BEYLA_DISCOVERY_SERVICES_0_INSTRUMENTATIONS=http \
9
    grafana/beyla:latest

1
// uprobe 拦截 HTTP 请求处理函数，提取 trace context
2
SEC("uprobe/http_server_handle_request")
3
int trace_http(struct pt_regs *ctx)
4
{
5
    // 从函数参数中提取 trace_id
6
    // 通过 Ring Buffer 发送到用户态
7
    // 用户态 Agent 关联 OTEL Span
8
    return 0;
9
}