BCC — eBPF Tracing and Performance Analysis Tools for Linux

What it is

BCC (BPF Compiler Collection) is a toolkit for creating and using eBPF tracing programs on Linux. It includes over 100 ready-to-use tools for performance analysis, networking debugging, and security observability: trace new process execution, monitor file opens, measure disk I/O latency, sniff DNS queries, and more. All without kernel module compilation or system restarts.

BCC targets SREs, performance engineers, kernel developers, and security teams who need deep visibility into Linux system behavior at the kernel level.

How it saves time or tokens

Traditional Linux debugging involves combining strace, perf, tcpdump, and custom scripts. Each tool covers one dimension. BCC provides purpose-built tools that answer specific questions immediately: which processes are consuming the most disk I/O, what syscalls are failing, which TCP connections have high latency. One command gives you answers that would take multiple tools and post-processing scripts.

How to use

1. Install BCC tools:

sudo apt-get install bpfcc-tools linux-headers-$(uname -r)

1. Run built-in tools (requires root):

sudo execsnoop-bpfcc          # Trace new process execution
sudo opensnoop-bpfcc          # Trace file opens
sudo biolatency-bpfcc         # Disk I/O latency histogram
sudo tcpconnect-bpfcc         # Trace TCP connections

1. Each tool outputs real-time data. Use Ctrl+C to stop and see summaries.

Example

# Find which processes are doing the most disk I/O
sudo biotop-bpfcc

# Trace DNS queries
sudo dnssnoop-bpfcc

# Measure function latency in a running process
sudo funclatency-bpfcc -p $(pidof myapp) 'malloc'

# Count syscalls by process
sudo syscount-bpfcc -p $(pidof nginx)

Each command provides kernel-level insights with minimal overhead.

Related on TokRepo

• Monitoring Tools -- System observability and monitoring tools
• Security Tools -- Security analysis and observability

Common pitfalls

• BCC tools require root access and kernel headers. Missing kernel headers is the most common installation failure. Ensure linux-headers-$(uname -r) is installed.
• eBPF programs run in kernel space. A buggy custom eBPF program can impact system stability. Stick to the pre-built tools unless you understand eBPF verification.
• BCC has higher startup overhead than bpftrace because it compiles BPF programs at runtime. For frequently run tools, consider pre-compiled alternatives.