bpfcc-tools or bcc-tools commands

@amitmund September 11, 2026

The bcc-tools package (packaged as bpfcc-tools on Debian/Ubuntu and bcc-tools on RHEL/CentOS/Fedora) provides a suite of production-grade eBPF tools for tracing Linux kernel and user-space subsystems.

On RHEL/CentOS systems, binaries are installed in /usr/share/bcc/tools/. On Debian/Ubuntu systems, they are installed into /usr/sbin/ with a -bpfcc suffix (e.g., opensnoop-bpfcc).

1. Block Device & Filesystem I/O

Command	Traced Subsystem	Primary Function
`biolatency`	Block Layer	Measures block device I/O latency distributions as power-of-2 histograms.
`biosnoop`	Block Layer	Traces individual block device I/O requests per line with PID, sector, and latency.
`biotop`	Block Layer	Interactive, `top`-like display of disk throughput and IOPS per process.
`bitesize`	Block Layer	Visualizes histograms of requested block I/O sizes per process.
`ext4dist` / `xfsdist`	Filesystem	Plots operation latency histograms for ext4 or XFS reads, writes, opens, and syncs.
`ext4slower` / `xfsslower`	Filesystem	Traces individual ext4 or XFS operations that exceed a microsecond threshold.
`zfsdist` / `zfsslower`	Filesystem	Latency distributions and slow operation tracing for ZFS on Linux.
`btrfsdist` / `btrfsslower`	Filesystem	Latency distributions and slow operation tracing for Btrfs.
`fio`	Block Layer	Wrapper and helper hooks for Flexible I/O tester benchmarks.
`filelife`	VFS Layer	Traces short-lived files by measuring lifespan from creation to deletion.
`fileslower`	VFS Layer	Traces synchronous file reads and writes exceeding a specified latency threshold.
`filetop`	VFS Layer	Interactive `top`-like display of read/write bandwidth and IOPS per file.
`mdflush`	Software RAID	Traces flush operations sent to Linux Multiple Device (`md`) software RAID arrays.
`mountsnoop`	VFS Layer	Traces `mount()` and `umount()` system calls system-wide with arguments.
`syncsnoop`	VFS Layer	Traces calls to `sync()`, `syncfs()`, `fsync()`, and `fdatasync()`.
`vfsstat`	VFS Layer	Counts VFS calls (read, write, open, create, fsync) at fixed intervals.

2. CPU Scheduling & Process Lifecycle

Command	Traced Subsystem	Primary Function
`cpudist`	CPU Scheduler	Measures on-CPU task execution duration histograms.
`cpuunclaimed`	CPU Scheduler	Tracks unclaimed CPU idle time when runnable processes were waiting in run queues.
`execsnoop`	Process Execution	Traces new process execution via `execve()` system calls with full argument arrays.
`exitsnoop`	Process Lifecycle	Traces process termination, lifetimes, and exit status codes.
`killsnoop`	Signal Handling	Traces signals sent via `kill()` with sender PID, target PID, and signal number.
`offcputime`	CPU Scheduler	Summarizes blocking time and kernel/user call stacks for tasks off-CPU.
`offwaketime`	CPU Scheduler	Traces off-CPU time alongside the wake-up stack trace that unblocked the task.
`profile`	CPU Sampling	Samples CPU stack traces at a target frequency (Hz) for flame graph generation.
`runqlat`	CPU Scheduler	Measures CPU run-queue scheduler latency (time spent runnable waiting for a core).
`runqlen`	CPU Scheduler	Measures CPU run-queue scheduler backlog depth as a histogram.
`runqslower`	CPU Scheduler	Streams individual processes that waited longer than a millisecond threshold to be scheduled.
`threadsnoop`	Threading	Traces POSIX thread creation (`pthread_create()`) with parent/child thread details.

3. Memory Subsystem & Virtual Filesystem Caches

Command	Traced Subsystem	Primary Function
`cachestat`	Page Cache	Displays real-time Linux page cache hit and miss statistics.
`cachetop`	Page Cache	Interactive `top`-like view of page cache read and write hits per process.
`dcstat`	Directory Cache	Displays Directory Entry Cache (dcache) lookup statistics and hit rates.
`dctop`	Directory Cache	Interactive view of processes driving dentry cache lookups and hit ratios.
`memleak`	Memory Allocation	Detects memory leaks by tracing allocated user-space and kernel memory blocks.
`mmapsnoop`	Memory Allocation	Traces `mmap()` system calls with requested memory flags and protection bits.
`oomkill`	Memory Manager	Traces kernel Out-Of-Memory (OOM) killer terminations and victim memory metrics.
`shmsnoop`	Shared Memory	Traces System V and POSIX shared memory allocations and attachments.
`slabratetop`	Kernel Slab	Interactive view of the highest-rate kernel slab allocator memory consumers.
`swapin`	Virtual Memory	Counts swap-in events per process to identify swap thrashing sources.

4. Networking & Socket Operations

Command	Traced Subsystem	Primary Function
`gethostlatency`	DNS Resolution	Measures latency of DNS hostname lookups (`getaddrinfo`, `gethostbyname`).
`netqtop`	Network Interface	Displays packet processing and queue distribution across NIC hardware queues.
`sofdsnoop`	UNIX Sockets	Traces file descriptor passing over UNIX domain sockets via `sendmsg()` / `recvmsg()`.
`solisten`	Socket Layer	Traces processes opening listening TCP sockets with port and backlog limits.
`tcpaccept`	TCP Layer	Traces inbound TCP connection establishments (`accept()`).
`tcpconnect`	TCP Layer	Traces outbound active TCP connection attempts (`connect()`).
`tcpconnlat`	TCP Layer	Measures the round-trip duration of the initial outbound TCP 3-way handshake.
`tcpdrop`	TCP Layer	Logs kernel packet drops with local/remote endpoints and kernel stack traces.
`tcplife`	TCP Layer	Logs a single summary line upon TCP session closure with total duration and bytes.
`tcpretrans`	TCP Layer	Traces TCP retransmissions with endpoints and socket connection state.
`tcpslower`	TCP Layer	Traces established TCP reads and writes exceeding a specified latency threshold.
`tcpstates`	TCP State Machine	Traces all TCP state transitions (`SYN_SENT`, `ESTABLISHED`, `FIN_WAIT`) per socket.
`tcpsubnet`	TCP Layer	Aggregates and displays IPv4 send/receive throughput grouped by target subnet.
`tcptop`	TCP Layer	Interactive `top`-like display of active TCP throughput (KB/s) per process.

5. Multi-Purpose Kernel Tracing & Probing Engines

Command	Scope	Primary Function
`argdist`	Dynamic Probing	Displays histograms or frequency distributions of function arguments.
`capable`	Linux Capabilities	Traces security capability checks (`cap_capable()`) to debug authorization faults.
`funccount`	Dynamic Probing	Counts invocation rates of matching kernel or user-space functions.
`funclatency`	Dynamic Probing	Measures invocation-to-return latency of kernel or user functions as a histogram.
`hardirqs`	Hardware Interrupts	Measures time spent processing hardware IRQ service routines.
`llcstat`	CPU Hardware PMUs	Measures CPU Last-Level Cache (LLC) hit and miss rates per process.
`reset-trace`	Diagnostics	Cleans up orphaned or lingering kprobes and uprobes in the kernel tracing system.
`softirqs`	Software Interrupts	Measures execution duration and latency distributions of kernel softirqs.
`stackcount`	Dynamic Probing	Aggregates and counts unique kernel or user-space call stack traces matching a probe.
`syscount`	System Calls	Counts and times system call executions globally or per process.
`trace`	Dynamic Probing	General-purpose CLI probe tracer with custom print formatting and filter logic.
`tplist`	Tracepoint Index	Lists all available static kernel tracepoints, USDT markers, and function probes.

6. Application, Shell & Runtime Tracers