At my previous job, I wrote a simple bpftrace script [1] to track Python2 invocations. The output of this program was sent to a message bus and eventually stored in a columnar database for exploration.

While Python2 got removed from the base operating system image, we wanted to uncover weird edge cases of engineers running special builds. We found more than one :)

I think BPF is underused for safe deprecations. It's super useful to prove that an executable is not loaded, or that a method is not called while being traced :)

[1]: https://github.com/javierhonduco/bpf-playground/blob/master/...