3 ms·

Can you explain, for someone who isn't familiar with the kernel, why there are so many different and apparently overlapping tracing tools built in, instead of j

Can you explain, for someone who isn't familiar with the kernel, why there are so many different and apparently overlapping tracing tools built in, instead of just one? Are there plans to clean up and unify them under something like bcc? Another example of duplication is BPF and iptables, but I suppose iptables isn't going away soon simply because it's so popular (and, compared to BPF, simple to use)?

brendangregg 11y ago
There's at least 9 different tracers for Linux, but only 3 built-in. - perf_events (the "perf" command), which is intended as the official end-user profiler/tracer. It's great at PMCs and sampling. It can do dynamic tracing and tracepoints. - ftrace (currently being renamed to "trace", to bring its ambiguity on-par with doing an internet search for "perf"), which is really a collection of custom lightweight tracing capabilities, developed to aid the real time kernel work. - eBPF, which is an engine that both perf_events and trace could make use of. I talked about the more here: http://www.brendangregg.com/blog/2015-07-08/choosing-a-linux-tracer.html http://www.brendangregg.com/blog/2015-07-08/choosing-a-linux... So you could say that the plan is there is one: perf_events. There's already work to bring eBPF to perf. perf already has a Python scripting interface, so it's not inconceivable that one day bcc will become part of perf. Some (f)trace capabilities could be rewritten/improved in eBPF, which could mean some cleanup. But the ftrace implementation wasn't bulky to start with.