The BCC collection of BPF tools

BCC is a high level frontend for BPF programs, which exposes access to the full BPF feature set.

The BCC tools collection contains a huge library of example scripts which are useful Linux utilities. These tools can gather and present data about the system which were not available before the introduction of BPF.

For example, execsnoop.py can log all forks system-wide, catching processes that may have been created and exited within the minimum collection interval of a utility like top.

By using these tools you will learn things about your system that you have never known before.