Show HN: whytime: time(1) that tells you where the wall-clock time went

time says a command took 3.8 seconds... whytime tells you where those seconds went:

  $ sudo whytime -- sh -c 'sleep 0.5; dd … oflag=dsync; curl -s -o /dev/null https://speed.cloudflare.com/…'
  wall 3.83s
    47%  blocked on network: speed.cloudflare.com:443 (1 connection)
    34%  fsync on ~/.cache
    13%  timer sleep (sleep)
     4%  on-CPU (curl)
     2%  other

The lines always add up to 100%. When the command waits on a child or another thread, whytime follows whoever woke it up, so a shell waiting on curl is charged to the network wait curl was stuck on. The top line is what you'd have to make faster.

It can also draw a flamegraph.

Uses eBPF (Linux 5.18+)